Wordfence Intelligence Weekly WordPress Vulnerability Report (March 3, 2025 to March 9, 2025)
📢 Did you know Wordfence runs a Bug Bounty Program for all WordPress plugins and themes at no cost to vendors? Researchers can earn up to $31,200 per vulnerability, for all in-scope vulnerabilities submitted to our Bug Bounty Program! Find a vulnerability, submit the details directly to us, and we handle all the rest.
Last week, there were 180 vulnerabilities disclosed in 134 WordPress Plugins and 12 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 62 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.
Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.
Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 24,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
New Firewall Rules Deployed Last Week
The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.
The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:
- WAF-RULE-812 – Data redacted while we work with the vendor on a patch.
Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.
Total Unpatched & Patched Vulnerabilities Last Week
| Patch Status | Number of Vulnerabilities |
|---|---|
| Patched | 146 |
| Partially Patched | 1 |
| Unpatched | 33 |
Total Vulnerabilities by CVSS Severity Last Week
| Severity Rating | Number of Vulnerabilities |
|---|---|
| Medium Severity | 139 |
| High Severity | 31 |
| Critical Severity | 10 |
Total Vulnerabilities by CWE Type Last Week
| Vulnerability Type by CWE | Number of Vulnerabilities |
|---|---|
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 82 |
| Missing Authorization | 23 |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 17 |
| Cross-Site Request Forgery (CSRF) | 16 |
| Deserialization of Untrusted Data | 5 |
| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 5 |
| Authentication Bypass Using an Alternate Path or Channel | 4 |
| Exposure of Sensitive Information to an Unauthorized Actor | 4 |
| Improper Privilege Management | 4 |
| Unrestricted Upload of File with Dangerous Type | 4 |
| Improper Control of Generation of Code ('Code Injection') | 3 |
| Server-Side Request Forgery (SSRF) | 3 |
| Authorization Bypass Through User-Controlled Key | 2 |
| Improper Authentication | 2 |
| Improper Authorization | 2 |
| External Control of File Name or Path | 1 |
| Improper Access Control | 1 |
| Improper Input Validation | 1 |
| SQL Injection: Hibernate | 1 |
Researchers That Contributed to WordPress Security Last Week
| Researcher Name | Number of Vulnerabilities |
|---|---|
| 20 | |
| 16 | |
| 14 | |
| 10 | |
| 10 | |
| 9 | |
| 7 | |
| 6 | |
| 6 | |
| 4 | |
| 3 | |
| 3 | |
| 3 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.
WordPress Plugins with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| Ad Inserter – Ad Manager & AdSense Ads | ad-inserter |
| Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution | file-manager-advanced |
| Advanced Form Integration — Connect Forms to 300+ Apps | advanced-form-integration |
| Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit | aiomatic-automatic-ai-content-writer |
| Allow PHP Execute | allow-php-execute |
| Animation Addons for Elementor Pro | animation-addons-for-elementor-pro |
| Auto Prune Posts | auto-prune-posts |
| bbPress | bbpress |
| Booknetic | booknetic |
| Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors | publishpress-authors |
| Code Snippets CPT | code-snippets-cpt |
| CoffeeCode – Checkout for Getnet and WooCommerce | wc-checkout-getnet |
| Contact Form & SMTP Plugin for WordPress by PirateForms | pirate-forms |
| Content Control – The Ultimate Content Restriction Plugin! Restrict Content, Create Conditional Blocks & More | content-control |
| Cookiebot by Usercentrics – Automatic Cookie Banner for GDPR/CCPA & Google Consent Mode | cookiebot |
| CS Framework | cs-framework |
| CURCY - WooCommerce Multi Currency - Currency Switcher | woocommerce-multi-currency |
| CYAN Backup | cyan-backup |
| DesignThemes Core Features | designthemes-core-features |
| Ditty – Responsive News Tickers, Sliders, and Lists | ditty-news-ticker |
| Downloable by American Osteopathic Association | aoa-downloadable |
| ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce | erp |
| Event Tickets with Ticket Scanner | event-tickets-with-ticket-scanner |
| Eventer - WordPress Event & Booking Manager Plugin | eventer |
| EventPrime – Events Calendar, Bookings, Tickets & AI | eventprime-event-calendar-management |
| Favorites | favorites |
| Flexmls® IDX Plugin | flexmls-idx |
| Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder | form-maker |
| Gallery : FooGallery | foogallery |
| Gallery by BestWebSoft – Customizable Image and Photo Galleries for WordPress | gallery-plugin |
| Gallery Styles | gallery-styles |
| GEO Plugin by Squirrly SEO | squirrly-seo |
| GiveWP – Donation Plugin and Fundraising Platform | give |
| Greek Multi Tool – Greeklish Slugs, Permalinks & Transliteration | greek-multi-tool |
| Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns | essential-blocks |
| HD Quiz | hd-quiz |
| Hero Maps Premium | hmapsprem |
| Hero Mega Menu - Responsive WordPress Menu Plugin | hmenu |
| Hero Slider - WordPress Slider Plugin | hslide |
| Homey Login Register | homey-login-register |
| HT Mega Addons for Elementor – Elementor Widgets & Template Builder | ht-mega-for-elementor |
| I Am Gloria | gloria-assistant-by-webtronic-labs |
| Icegram Engage – Popups, Optins, CTAs & Lead Generation | icegram |
| InWave Jobs | iwjob |
| IP Based Login | ip-based-login |
| Javo Core | javo-core |
| Job Postings | job-postings |
| JSFiddle Shortcode | jsfiddle-shortcode |
| Lead Form Builder & Contact Form | lead-form-builder |
| LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes | lifterlms |
| m1.DownloadList | m1downloadlist |
| MailPoet – Newsletters, Email Marketing, and Automation | mailpoet |
| Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits | master-addons |
| Master Slider – Responsive Touch Slider | master-slider |
| MB Custom Post Types & Custom Taxonomies | mb-custom-post-type |
| miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon | miniorange-login-openid |
| Mobile Contact Bar | mobile-contact-bar |
| Moving Media Library | moving-media-library |
| Multiple Shipping And Billing Address For WooCommerce | different-shipping-and-billing-address-for-woocommerce |
| Notibar – Notification Bar for WordPress | notibar |
| Page Builder: Pagelayer – Drag and Drop website builder | pagelayer |
| Platform.ly for WooCommerce | platformly-for-woocommerce |
| Podlove Podcast Publisher | podlove-podcasting-plugin-for-wordpress |
| Point Maker | point-maker |
| Post Lockdown | post-lockdown |
| Post Meta Data Manager | post-meta-data-manager |
| Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App | post-smtp |
| Print Invoice & Delivery Notes for WooCommerce | woocommerce-delivery-notes |
| Prisna GWT – Google Website Translator | google-website-translator |
| Product Input Fields for WooCommerce | product-input-fields-for-woocommerce |
| Product Labels For Woocommerce (Sale Badges) | aco-product-labels-for-woocommerce |
| Razorpay Subscription Button Elementor Plugin | razorpay-subscription-button-elementor |
| Recapture for WooCommerce | recapture-for-woocommerce |
| Recently Purchased Products For Woo | recently-purchased-products-for-woo |
| RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login | custom-registration-form-builder-with-submission-manager |
| Registrations for the Events Calendar – Event Registration Plugin | registrations-for-the-events-calendar |
| Related Posts By PickPlugins | related-post |
| Responsive Lightbox & Gallery | responsive-lightbox |
| Robo Gallery – Photo & Image Slider | robo-gallery |
| School Management System for Wordpress | school-management |
| SearchIQ – The Search Solution | searchiq |
| Shortcode Cleaner Lite | shortcode-cleaner-lite |
| Shortcodes Ultimate – Content Elements | shortcodes-ultimate |
| Simple Banner – Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website | simple-banner |
| Simple Basic Contact Form | simple-basic-contact-form |
| Simple Notification | simple-notification |
| Simply Schedule Appointments | simply-schedule-appointments |
| Slider by 10Web – Responsive Image Slider | slider-wd |
| SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels) | slingblocks |
| Smart Maintenance Mode | smart-maintenance-mode |
| SMTP by BestWebSoft | bws-smtp |
| Social Slider Feed – Social Media Feed & Gallery Widgets | instagram-slider-widget |
| Solace Extra | solace-extra |
| Staff Directory Plugin: Company Directory | staff-directory-pro |
| Structured Content (JSON-LD) #wpsc | structured-content |
| Stylish Google Sheet Reader – Embed Google Sheets as Interactive Tables with Built-in Form Submissions | stylish-google-sheet-reader |
| Stylish Price List – Price Table Builder & QR Code Restaurant Menu | stylish-price-list |
| SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent | supportcandy |
| tarteaucitron.js for WordPress | tarteaucitron-wp |
| Taskbuilder – Project Management & Task Management Tool With Kanban Board | taskbuilder |
| teachPress | teachpress |
| The GDPR Framework By Data443 | gdpr-framework |
| The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce | the-plus-addons-for-elementor-page-builder |
| UiPress lite | Effortless custom dashboards, admin themes and pages | uipress-lite |
| Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin | ultimate-member |
| Ultimate Video Player WordPress & WooCommerce Plugin | fwduvp |
| Ultimate WordPress Auction Plugin | ultimate-auction |
| VikBooking Hotel Booking Engine & PMS | vikbooking |
| VikRentCar Car Rental Management System | vikrentcar |
| VK Blocks | vk-blocks |
| Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments | wallet-system-for-woocommerce |
| WidgetKit for Elementor – Lightweight Elementor Addons, Widgets & Templates | widgetkit-for-elementor |
| Wishlist | wishlist |
| Wishlist for WooCommerce: Multi Wishlists Per Customer | wish-list-for-woocommerce |
| WooCommerce Recover Abandoned Cart | rac |
| WooMail - WooCommerce Email Customizer | email-customizer-for-woocommerce-with-drag-drop-builder |
| WordPress Awesome Import & Export Plugin - Import & Export WordPress Data | wp-awesome-import-export |
| WordPress WP-Advanced-Search | wp-advanced-search |
| WP Featherlight – A Simple jQuery Lightbox | wp-featherlight |
| WP Google Review Slider | wp-google-places-review-slider |
| WP Online Contract | onlinecontract |
| WP Real Estate Manager | wp-realestate-manager |
| Wp Svg Upload | wp-svg-upload |
| WP Tabs | my-wp-tabs |
| WP-Recall – Registration, Profile, Commerce & More | wp-recall |
| WPBookit | wpbookit |
| WPBot – AI ChatBot for Live Support, Lead Generation, AI Services | chatbot |
| WPCOM Member | wpcom-member |
| WPGet API – Connect to any external REST API | wpgetapi |
| WPGSI: Spreadsheet Integration | wpgsi |
| Xpro Addons — 140+ Widgets for Elementor | xpro-elementor-addons |
| Years Since – Timeless Texts | years-since |
| Zigaform – Form Builder Lite | zigaform-form-builder-lite |
| ZoomSounds - WordPress Wave Audio Player with Playlist | dzs-zoomsounds |
WordPress Themes with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| Design Comuni Italia | design-comuni-wordpress-theme |
| Flex Mag - Responsive WordPress News Theme | flex-mag |
| Golo - City Travel Guide WordPress Theme | golo |
| Homey | homey |
| JNews - WordPress Newspaper Magazine Blog AMP Theme | jnews |
| Lafka - Multi Store Burger - Pizza & Food Delivery WooCommerce Theme | lafka |
| Listingo | listingo |
| Newscrunch | newscrunch |
| Sparkling | sparkling |
| VEDA - MultiPurpose WordPress Theme | veda |
| VW Storefront | vw-storefront |
| Zass - WooCommerce Theme for Handmade Artists and Artisans | zass |
Vulnerability Details
Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.
GiveWP – Donation Plugin and Fundraising Platform <= 3.19.4 - Unauthenticated PHP Object Injection
9.8
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Homey Login Register [homey-login-register]
Researcher
Affected Software
InWave Jobs [iwjob]
Researcher
Affected Software
Newscrunch [newscrunch]
Researcher
Affected Software
Researcher
Affected Software
WP Real Estate Manager [wp-realestate-manager]
Researcher
Affected Software
WPCOM Member [wpcom-member]
Researcher
Affected Software
Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit [aiomatic-automatic-ai-content-writer]
Researcher
Affected Software
Animation Addons for Elementor Pro [animation-addons-for-elementor-pro]
Researcher
Affected Software
CS Framework [cs-framework]
Researcher
Affected Software
Researcher
Affected Software
Newscrunch [newscrunch]
Researcher
Affected Software
School Management System for Wordpress [school-management]
Researcher
Affected Software
Researcher
Affected Software
VikRentCar Car Rental Management System [vikrentcar]
Researcher
Affected Software
WordPress Awesome Import & Export Plugin - Import & Export WordPress Data [wp-awesome-import-export]
Researcher
Affected Software
Flex Mag - Responsive WordPress News Theme [flex-mag]
Researcher
Affected Software
Homey [homey]
Researcher
Affected Software
miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon [miniorange-login-openid]
Researcher
Affected Software
Product Input Fields for WooCommerce [product-input-fields-for-woocommerce]
Researcher
Affected Software
Researcher
Affected Software
ZoomSounds - WordPress Wave Audio Player with Playlist [dzs-zoomsounds]
Researcher
Affected Software
CS Framework [cs-framework]
Researcher
Affected Software
CURCY - WooCommerce Multi Currency - Currency Switcher [woocommerce-multi-currency]
Researcher
Affected Software
DesignThemes Core Features [designthemes-core-features]
Researcher
Downloable by American Osteopathic Association <= 0.1.0 - Unauthenticated Arbitrary File Download
7.5
Affected Software
Downloable by American Osteopathic Association [aoa-downloadable]
Researcher
Affected Software
Multiple Shipping And Billing Address For WooCommerce [different-shipping-and-billing-address-for-woocommerce]
Researcher
Affected Software
Researcher
Affected Software
Researcher
WP-Recall – Registration, Profile, Commerce & More <= 16.26.10 - Unauthenticated SQL Injection
7.5
Affected Software
Researcher
Affected Software
Allow PHP Execute [allow-php-execute]
Researcher
Affected Software
Design Comuni Italia [design-comuni-wordpress-theme]
Researcher
Affected Software
Downloable by American Osteopathic Association [aoa-downloadable]
Researcher
Affected Software
Researcher
Affected Software
Post Meta Data Manager [post-meta-data-manager]
Researcher
Affected Software
SMTP by BestWebSoft [bws-smtp]
Researcher
Affected Software
Hero Maps Premium [hmapsprem]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Moving Media Library [moving-media-library]
Researcher
Affected Software
School Management System for Wordpress [school-management]
Researcher
Affected Software
School Management System for Wordpress [school-management]
Researcher
Affected Software
GEO Plugin by Squirrly SEO [squirrly-seo]
Researcher
Affected Software
Shortcode Cleaner Lite [shortcode-cleaner-lite]
Researcher
Affected Software
teachPress [teachpress]
Researcher
Affected Software
WP Online Contract [onlinecontract]
Researcher
Affected Software
Xpro Addons — 140+ Widgets for Elementor [xpro-elementor-addons]
Researcher
Affected Software
Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution [file-manager-advanced]
Researcher
Affected Software
Ditty – Responsive News Tickers, Sliders, and Lists [ditty-news-ticker]
Researcher
Affected Software
Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns [essential-blocks]
Researcher
Affected Software
Flexmls® IDX Plugin [flexmls-idx]
Researcher
Affected Software
Gallery : FooGallery [foogallery]
Researcher
Affected Software
Gallery Styles [gallery-styles]
Researcher
Affected Software
HT Mega Addons for Elementor – Elementor Widgets & Template Builder [ht-mega-for-elementor]
Researcher
Affected Software
Job Postings [job-postings]
Researcher
JSFiddle Shortcode <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
6.4
Affected Software
JSFiddle Shortcode [jsfiddle-shortcode]
Researcher
Affected Software
m1.DownloadList [m1downloadlist]
Researcher
Master Addons <= 2.0.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
6.4
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Master Slider – Responsive Touch Slider [master-slider]
Researcher
Affected Software
Master Slider – Responsive Touch Slider [master-slider]
Researcher
Affected Software
WP Featherlight – A Simple jQuery Lightbox [wp-featherlight]
Responsive Lightbox & Gallery [responsive-lightbox]
Researcher
Affected Software
Point Maker [point-maker]
Researcher
Affected Software
Recently Purchased Products For Woo [recently-purchased-products-for-woo]
Researcher
SearchIQ – The Search Solution <= 4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
SearchIQ – The Search Solution [searchiq]
Researcher
Affected Software
Simple Notification [simple-notification]
Researcher
Affected Software
Researcher
Affected Software
Structured Content (JSON-LD) #wpsc [structured-content]
Researcher
Affected Software
tarteaucitron.js for WordPress [tarteaucitron-wp]
Researcher
Affected Software
The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce [the-plus-addons-for-elementor-page-builder]
Researcher
Affected Software
Shortcodes Ultimate – Content Elements [shortcodes-ultimate]
Researcher
Affected Software
Researcher
Affected Software
Years Since – Timeless Texts [years-since]
Researcher
Affected Software
bbPress [bbpress]
Researcher
Affected Software
Researcher
Affected Software
Ad Inserter – Ad Manager & AdSense Ads [ad-inserter]
Researcher
Affected Software
Simply Schedule Appointments [simply-schedule-appointments]
Researcher
Affected Software
Staff Directory Plugin: Company Directory [staff-directory-pro]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
CoffeeCode – Checkout for Getnet and WooCommerce [wc-checkout-getnet]
Researcher
Affected Software
Razorpay Subscription Button Elementor Plugin [razorpay-subscription-button-elementor]
Researcher
Affected Software
Related Posts By PickPlugins [related-post]
Researcher
Affected Software
Stylish Google Sheet Reader – Embed Google Sheets as Interactive Tables with Built-in Form Submissions [stylish-google-sheet-reader]
Researcher
tarteaucitron.js for WordPress < 0.3.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
6.1
Affected Software
tarteaucitron.js for WordPress [tarteaucitron-wp]
Researcher
Affected Software
Wishlist for WooCommerce: Multi Wishlists Per Customer [wish-list-for-woocommerce]
Researcher
Affected Software
WPBookit [wpbookit]
Researcher
Affected Software
Zigaform – Form Builder Lite [zigaform-form-builder-lite]
Researcher
Affected Software
Print Invoice & Delivery Notes for WooCommerce [woocommerce-delivery-notes]
Researcher
Affected Software
Mobile Contact Bar [mobile-contact-bar]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit [aiomatic-automatic-ai-content-writer]
Researcher
Affected Software
Ultimate WordPress Auction Plugin [ultimate-auction]
Researcher
Affected Software
Wp Svg Upload [wp-svg-upload]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Platform.ly for WooCommerce [platformly-for-woocommerce]
Researcher
Affected Software
School Management System for Wordpress [school-management]
Researcher
Affected Software
School Management System for Wordpress [school-management]
Researcher
Affected Software
Researcher
Affected Software
Product Labels For Woocommerce (Sale Badges) [aco-product-labels-for-woocommerce]
Researcher
Affected Software
Product Labels For Woocommerce (Sale Badges) [aco-product-labels-for-woocommerce]
Researcher
Affected Software
Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors [publishpress-authors]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Advanced Form Integration — Connect Forms to 300+ Apps [advanced-form-integration]
Researcher
Affected Software
Advanced Form Integration — Connect Forms to 300+ Apps [advanced-form-integration]
Researcher
AI ChatBot for WordPress – WPBot <= 6.2.3 - Authenticated (Admin+) Stored Cross-Site Scripting
4.4
Affected Software
Researcher
Affected Software
Auto Prune Posts [auto-prune-posts]
Researcher
Affected Software
Contact Form & SMTP Plugin for WordPress by PirateForms [pirate-forms]
Researcher
Affected Software
Contact Form & SMTP Plugin for WordPress by PirateForms [pirate-forms]
Researcher
Affected Software
CYAN Backup [cyan-backup]
Researcher
Affected Software
CYAN Backup [cyan-backup]
Researcher
Affected Software
Favorites [favorites]
Researcher
Affected Software
Researcher
Affected Software
HD Quiz [hd-quiz]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
IP Based Login [ip-based-login]
Researcher
Affected Software
Researcher
Affected Software
MB Custom Post Types & Custom Taxonomies [mb-custom-post-type]
Researcher
Affected Software
Robo Gallery – Photo & Image Slider [robo-gallery]
Researcher
Affected Software
CoffeeCode – Checkout for Getnet and WooCommerce [wc-checkout-getnet]
Researcher
Affected Software
Podlove Podcast Publisher [podlove-podcasting-plugin-for-wordpress]
Researcher
Affected Software
Podlove Podcast Publisher [podlove-podcasting-plugin-for-wordpress]
Researcher
Affected Software
Prisna GWT – Google Website Translator [google-website-translator]
Researcher
Affected Software
Prisna GWT – Google Website Translator [google-website-translator]
Researcher
Affected Software
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login [custom-registration-form-builder-with-submission-manager]
Researcher
Registrations for the Events Calendar <= 2.13.2 - Authenticated (Admin+) Stored Cross-Site Scripting
4.4
Affected Software
Registrations for the Events Calendar – Event Registration Plugin [registrations-for-the-events-calendar]
Researcher
Affected Software
Lead Form Builder & Contact Form [lead-form-builder]
Researcher
Affected Software
Researcher
Affected Software
Simple Basic Contact Form [simple-basic-contact-form]
Researcher
Affected Software
Slider by 10Web – Responsive Image Slider [slider-wd]
Researcher
Slider by 10Web <= 1.2.61 - Authenticated (Administrator+) Stored Cross-Site Scripting via Widget
4.4
Affected Software
Slider by 10Web – Responsive Image Slider [slider-wd]
Researcher
Affected Software
Smart Maintenance Mode [smart-maintenance-mode]
Researcher
Affected Software
Smart Maintenance Mode [smart-maintenance-mode]
Researcher
Affected Software
Social Slider Feed – Social Media Feed & Gallery Widgets [instagram-slider-widget]
Researcher
Affected Software
Stylish Price List – Price Table Builder & QR Code Restaurant Menu [stylish-price-list]
Researcher
Affected Software
The GDPR Framework By Data443 [gdpr-framework]
Researcher
VikBooking Hotel Booking Engine & PMS <= 1.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting
4.4
Affected Software
VikBooking Hotel Booking Engine & PMS [vikbooking]
Researcher
Affected Software
WordPress WP-Advanced-Search [wp-advanced-search]
Researcher
Affected Software
Researcher
Affected Software
WP Google Review Slider [wp-google-places-review-slider]
Researcher
Affected Software
WP Tabs [my-wp-tabs]
Researcher
Affected Software
WidgetKit for Elementor – Lightweight Elementor Addons, Widgets & Templates [widgetkit-for-elementor]
Researcher
Affected Software
Booknetic [booknetic]
Researcher
Affected Software
Code Snippets CPT [code-snippets-cpt]
Researcher
Affected Software
Researcher
Event Tickets with Ticket Scanner <= 2.5.3 - Cross-Site Request Forgery to Arbitrary Ticket Deletion
4.3
Affected Software
Event Tickets with Ticket Scanner [event-tickets-with-ticket-scanner]
Researcher
Affected Software
EventPrime – Events Calendar, Bookings, Tickets & AI [eventprime-event-calendar-management]
Researcher
Affected Software
Gallery : FooGallery [foogallery]
Researcher
Affected Software
Homey [homey]
Researcher
Affected Software
I Am Gloria [gloria-assistant-by-webtronic-labs]
Researcher
Affected Software
IP Based Login [ip-based-login]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Podlove Podcast Publisher <= 4.2.2 - Cross-Site Request Forgery via ajax_transcript_delete Function
4.3
Affected Software
Podlove Podcast Publisher [podlove-podcasting-plugin-for-wordpress]
Researcher
Affected Software
Post Lockdown [post-lockdown]
Researcher
Affected Software
Recapture for WooCommerce [recapture-for-woocommerce]
Researcher
Affected Software
GEO Plugin by Squirrly SEO [squirrly-seo]
Researcher
Affected Software
WPGSI: Spreadsheet Integration [wpgsi]
Researcher
Affected Software
Researcher
Affected Software
VW Storefront [vw-storefront]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
WooMail - WooCommerce Email Customizer [email-customizer-for-woocommerce-with-drag-drop-builder]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.
This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
Comments