Wordfence Intelligence Weekly WordPress Vulnerability Report (April 21, 2025 to April 27, 2025)
📢 In case you missed it, Wordfence just published its annual WordPress security report for 2024. Read it now to learn more about the evolving risk landscape of WordPress so you can keep your sites protected in 2025 and beyond.
Last week, there were 239 vulnerabilities disclosed in 206 WordPress Plugins and 15 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 56 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.
Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.
Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 26,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
New Firewall Rules Deployed Last Week
The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.
The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:
- My Tickets – Accessible Event Ticketing <= 2.0.16 – Authenticated (Subscriber+) Privilege Escalation
- WAF-RULE-822 – Data redacted while we work with the vendor on a patch.
- WAF-RULE-824 – Data redacted while we work with the vendor on a patch.
Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.
Total Unpatched & Patched Vulnerabilities Last Week
| Patch Status | Number of Vulnerabilities |
|---|---|
| Patched | 106 |
| Unpatched | 133 |
Total Vulnerabilities by CVSS Severity Last Week
| Severity Rating | Number of Vulnerabilities |
|---|---|
| Medium Severity | 179 |
| High Severity | 35 |
| Critical Severity | 25 |
Total Vulnerabilities by CWE Type Last Week
| Vulnerability Type by CWE | Number of Vulnerabilities |
|---|---|
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 97 |
| Cross-Site Request Forgery (CSRF) | 42 |
| Missing Authorization | 22 |
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | 16 |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 16 |
| Deserialization of Untrusted Data | 11 |
| Improper Control of Generation of Code ('Code Injection') | 6 |
| Server-Side Request Forgery (SSRF) | 5 |
| Unrestricted Upload of File with Dangerous Type | 5 |
| Improper Privilege Management | 4 |
| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 3 |
| Unverified Password Change | 3 |
| Exposure of Sensitive Information to an Unauthorized Actor | 2 |
| External Control of Assumed-Immutable Web Parameter | 2 |
| Authorization Bypass Through User-Controlled Key | 1 |
| Improper Authentication | 1 |
| Incorrect Authorization | 1 |
| Incorrect Privilege Assignment | 1 |
| Insertion of Sensitive Information Into Sent Data | 1 |
Researchers That Contributed to WordPress Security Last Week
| Researcher Name | Number of Vulnerabilities |
|---|---|
| 49 | |
| 16 | |
| 15 | |
| 12 | |
| 11 | |
| 10 | |
| 8 | |
| 7 | |
| 7 | |
| 6 | |
| 6 | |
| 5 | |
| 5 | |
| 4 | |
| 4 | |
| 4 | |
| 4 | |
| 4 | |
| 4 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.
WordPress Plugins with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| 1 Decembrie 1918 | 1-decembrie-1918 |
| 360 View | 360-view |
| Able Player, accessible HTML5 media player | ableplayer |
| Absolute Links | absolute-links |
| ACF: Google Font Selector | acf-google-font-selector-field |
| Add custom page template | add-custom-page-template |
| Add Google +1 (Plus one) social share Button | add-google-plus-one-social-share-button |
| Advanced Accordion Gutenberg Block – Create Beautiful FAQs, Content Accordions & Interactive Tabs | advanced-accordion-block |
| Advanced lazy load | advanced-lazy-load |
| Aeropage Sync for Airtable | aeropage-sync-for-airtable |
| affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display | affiliate-toolkit-starter |
| Ajax Comment Form CST | ajax-comment-form-cst |
| All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier | aio-time-clock-lite |
| Alt Text AI – Automatically generate image alt text for SEO and accessibility | alttext-ai |
| AnalyticsWP | analyticswp |
| Animate | animate |
| Anps Theme plugin | anps_theme_plugin |
| Anything Popup | anything-popup |
| Appointment Booking Calendar | appointment-booking-calendar |
| Appsero Helper | appsero-helper |
| Author Box After Posts | author-box-after-posts |
| Author Box Plugin With Different Description | author-box-with-different-description |
| Availability Calendar | availability |
| Awesome Wp Image Gallery | awesome-wp-image-gallery |
| BBCode Deluxe | bbcode-deluxe |
| BeerXML Shortcode | beerxml-shortcode |
| Best Posts Summary | best-posts-summary |
| Best Quiz Plugin for WordPress: WP Quiz | wp-quiz |
| Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder | bit-form |
| Blog Manager WP | blog-manager-wp |
| BM Content Builder | bm-builder |
| Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools | woocommerce-jetpack |
| Breeze Display | wt-display-breeze |
| Buddypress Force Password Change | buddy-press-force-password-change |
| Bulk Assign Linked Products For WooCommerce | wc-bulk-assign-linked-products |
| Business Contact Widget | business-contact-widget |
| Call Now PHT Blog | call-now-coccoc-pht-blog |
| Capturly | capturly-optimize-your-website |
| Car Park Booking System for WordPress | car-park-booking-system-for-wordpress |
| Carousel-of-post-images | carousel-of-post-images |
| CheckBot | checkbot |
| Checkout Field Visibility for eCommerce | checkout-field-visibility-for-woocommerce |
| CM Ad Changer – A simple tool to control and optimize your site's banners | cm-ad-changer |
| CM Answers – Discussion Forum Plugin for WordPress Q&A | cm-answers |
| Configurator Theme Core | amz-configurator-core |
| Confirm User Registration | confirm-user-registration |
| Contact Form 7 Calendar | cf7-calendar |
| Control Listings – Classifieds Ads Directory Portal Manager | control-listings |
| cookieBAR | cookiebar |
| COVID-19 (Coronavirus) Update Your Customers | covid-19-alert |
| Create custom forms for WordPress with a smart form plugin for smart businesses – Form builder for WordPress | abcsubmit |
| Crossword Compiler Puzzles | crossword-compiler-puzzles |
| Custom Admin-Bar Favorites | admin-bookmarks |
| Custom Functions Plugin | custom-functions |
| Custom Login and Registration | ms-registration |
| Custom Related Posts | custom-related-posts |
| Database Toolset | database-toolset |
| Directory Listings WordPress plugin – uListing | ulisting |
| Document Management System | dms |
| Drop Caps | drop-caps |
| Dropdown Content | dropdown-content |
| Easy Child Theme Creator | easy-child-theme-creator |
| Easy Notify Lite | easy-notify-lite |
| eForm - WordPress Form Builder | wp-fsqm-pro |
| Element Pack – Widgets, Templates & Addons for Elementor | bdthemes-element-pack-lite |
| ELEX WooCommerce Bulk Edit Products, Prices & Attributes (Basic) | elex-bulk-edit-products-prices-attributes-for-woocommerce-basic |
| Embed Lottie Player – Add Interactive Lottie Animations with Block Support | embed-lottie-player |
| Enhanced Paypal Shortcodes | enhanced-paypal-shortcodes |
| Event Post | event-post |
| Evergreen Content Poster – Auto Post and Schedule Your Best Content to Social Media | evergreen-content-poster |
| External Markdown | external-markdown |
| Fable Extra | fable-extra |
| FAT Services Booking | fat-services-booking |
| Firelight Lightbox | easy-fancybox |
| Flickr Shortcode Importer | flickr-shortcode-importer |
| Floating Social Bar | floating-social-bar |
| Flynax Bridge | flynax-bridge |
| Foodbakery Sticky Cart | foodbakery-sticky-cart |
| Frontend Dashboard | frontend-dashboard |
| FuseDesk | fusedesk |
| GNA Search Shortcode | gna-search-shortcode |
| Google News | google-news |
| Greenshift – animation and page builder blocks | greenshift-animation-and-page-builder-blocks |
| GTDB Guitar Tuners | guitar-tuner |
| GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor | gutenkit-blocks-addon |
| Hacklog Remote Attachment | hacklog-remote-attachment |
| Hospital Management System for Wordpress | hospital-management |
| HTML Forms – Simple WordPress Forms Plugin | html-forms |
| iCafe Library | icafe-library |
| Image Hover Effects For WPBakery Page Builder | image-hover-effects-for-visual-composer |
| Image Optimizer, Resizer and CDN – Sirv | sirv |
| Image Style Hover – Displays content when you hover on image | image-content-show-hover |
| Inline Text Popup | inline-text-popup |
| Integração entre Eduzz e Woocommerce | integracao-entre-eduzz-e-wc-powers |
| JobSearch WP Job Board | wp-jobsearch |
| Jupiter X Core | jupiterx-core |
| Kali Forms — Contact Form & Drag-and-Drop Builder | kali-forms |
| Landing pages and Domain aliases for WordPress | landing-pages-and-domain-aliases |
| Libro de Reclamaciones | libro-de-reclamaciones |
| License For Envato | license-envato |
| LightPress Lightbox | wp-jquery-lightbox |
| Link Library | link-library |
| Linked Variations for WooCommerce – Link Separate Products by Attribute with Swatches, Quick View & Shortcodes | linked-variation |
| List Last Changes | list-last-changes |
| Loan Calculator | repayment-calculator |
| Login, Registration and Lost Password Blocks | frontend-login-and-registration-blocks |
| LSD Custom taxonomy and category meta | custom-taxonomy-category-and-term-fields |
| Mad Mimi for WordPress | mad-mimi |
| Mailing Group Listserv | wp-mailing-group |
| Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin | majestic-support |
| Mang Board WP | mangboard |
| Mayosis Core | mayosis-core |
| Media Library Downloader | media-library-downloader |
| Memberpress | memberpress |
| Message Filter for Contact Form 7 | cf7-message-filter |
| Milat jQuery Automatic Popup | milat-jquery-automatic-popup |
| Mini twitter feed | mini-twitter-feed |
| Mixcloud Embed | mixcloud-embed |
| Modern Polls | modern-polls |
| MPL-Publisher — Ebook & Audiobook Creator | mpl-publisher |
| Multi-Column Taxonomy List | multi-column-taxonomy-list |
| My Custom Widgets | mycustomwidget |
| My Tickets – Accessible Event Ticketing | my-tickets |
| Navegg Analytics | navegg |
| Nepali Post Date | nepali-post-date |
| occupancyplan | occupancyplan |
| Ocean Extra | ocean-extra |
| PayPal Express Checkout | paypal-express-checkout |
| Peadig’s Google +1 Button | google-1 |
| Peekaboo | peekaboo |
| Plugin Central | plugin-central |
| Post in page for Elementor | post-in-page-for-elementor |
| Posts for Page | posts-for-page |
| PowerPress Podcasting plugin by Blubrry | powerpress |
| Premmerce Wholesale Pricing for WooCommerce | premmerce-woocommerce-wholesale-pricing |
| Prevent Direct Access – Protect WordPress Files | prevent-direct-access |
| Print Science Designer | print-science-designer |
| Product Lister for eBay | product-lister-ebay |
| RAphicon | raphicon |
| Recover abandoned cart for WooCommerce | recover-wc-abandoned-cart |
| Related Posts via Taxonomies | related-posts-via-taxonomies |
| Responsive Lightbox & Gallery | responsive-lightbox |
| Revy | revy |
| RRSSB | rrssb |
| SCSS-Library | scss-library |
| Send From | send-from |
| Seriously Simple Podcasting | seriously-simple-podcasting |
| Service Finder Bookings | sf-booking |
| SEUR Oficial | seur |
| ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin | woolentor-addons |
| Simple calendar for Elementor | simple-calendar-for-elementor |
| Simple Download Counter | simple-download-counter |
| Simple Google Photos Grid | simple-google-photos-grid |
| Simple Lightbox | simple-lightbox |
| Simple Shopping Cart | wordpress-simple-paypal-shopping-cart |
| SKT Blocks – Gutenberg based Page Builder | skt-blocks |
| Sky Addons for Elementor | sky-elementor-addons |
| Smart Hashtags [#hashtagger] | hashtagger |
| Social Counter & Sharer | social-counter |
| Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light | excel-like-price-change-for-woocommerce-and-wp-e-commerce-light |
| SUMO Reward Points for WooCommerce | rewardsystem |
| Tax Switch for WooCommerce | tax-switch-for-woocommerce |
| Tayori Form Plugin | tayori |
| Textmetrics | webtexttool |
| The Pack Elementor addon | the-pack-addon |
| Theme Switcha – Easily Switch Themes for Development and Testing | theme-switcha |
| Time Based Greeting | time-based-greeting |
| Twitter Card Generator | twitter-card-generator |
| UiCore Elements – Free widgets and templates for Elementor | uicore-elements |
| Unsafe Mimetypes | unsafe-mimetypes |
| Upsell Funnel Builder for WooCommerce – Create Upsells, Cross-Sells, Order Bumps, Frequently Bought, and Popups. | upsell-order-bump-offer-for-woocommerce |
| User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder | user-registration |
| Vasaio QR Code | vasaio-qr-code |
| Verification SMS with TargetSMS | verification-sms-targetsms |
| VikRestaurants Table Reservations and Take-Away | vikrestaurants |
| Visual Composer Website Builder | visualcomposer |
| VPSUForm – Drag & Drop Contact Form Builder with Email Automation | v-form |
| Watu Quiz | watu |
| Woocommerce Automatic Order Printing | ( Formerly WooCommerce Google Cloud Print) | xc-woo-google-cloud-print |
| WordPress Easy Guide | wp-easy-guide |
| WordPress Events Calendar Registration & Tickets | wpeventplus |
| WordPress Tabs | gt-tabs |
| WordPress Tooltip | wp-tooltip |
| WoWHead Tooltips | wowhead-tooltips |
| WP AVCL Automation Helper (formerly WPFlyLeads) | woozap |
| WP Cookie Consent | wp-cookie-consent |
| Wp Custom CMS Block | wp-custom-cms-block |
| WP Custom Post Popup | custom-post-popup |
| WP Customize Login Page | wp-customize-login-page |
| WP Filter Post Category | wp-filter-post-categories |
| WP Foodbakery | wp-foodbakery |
| WP HRM LITE | wp-hrm-lite-human-resource-management-system |
| WP Import Export Lite | wp-import-export-lite |
| WP Vegas | vegas-fullscreen-background-slider |
| wp-cyr-cho | Конвертира кирилски символи в латиниски | wp-cyr-cho |
| WP-reCAPTCHA-bp | wp-recaptcha-bp |
| WPMasterToolKit (WPMTK) – All in one plugin | wpmastertoolkit |
| WPVN – Username Changer | wpvn-username-changer |
| WpZon – Amazon Affiliate Plugin | wpzon |
| WS Force Login Page | ws-force-login-page |
| WS Form LITE – Drag & Drop Contact Form Builder | ws-form |
| Xelion Webchat | xelion-webchat |
| Xpert Tab | xpert-tab |
| Xpro Elementor Addons - Pro | xpro-elementor-addons-pro |
| Zalo Official Live Chat | zalo-official-live-chat |
| Zoho Creator Forms | zohocreator |
WordPress Themes with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| Altair | altair |
| Arrival | arrival |
| bellevuex | bellevuex |
| CiyaShop - Multipurpose WooCommerce Theme | ciyashop |
| CWW Portfolio | cww-portfolio |
| EduMall - Professional LMS Education Center WordPress Theme | edumall |
| Grace Mag | grace-mag |
| Grand Conference | Event WordPress | grandconference |
| Grand Restaurant WordPress | grandrestaurant |
| JNews - WordPress Newspaper Magazine Blog AMP Theme | jnews |
| Opstore | opstore |
| Reales WP - Real Estate WordPress Theme | reales-wp-real-estate-wordpress-theme |
| Vikinger | vikinger |
| wProject | wproject |
| Xews Lite | xews-lite |
Vulnerability Details
Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.
Affected Software
Arrival [arrival]
Researcher
Affected Software
Capturly [capturly-optimize-your-website]
Researcher
Affected Software
Checkout Field Visibility for eCommerce [checkout-field-visibility-for-woocommerce]
Researcher
Affected Software
CiyaShop - Multipurpose WooCommerce Theme [ciyashop]
Researcher
Affected Software
CWW Portfolio [cww-portfolio]
Researcher
Affected Software
Fable Extra [fable-extra]
Researcher
Affected Software
Flynax Bridge [flynax-bridge]
Researcher
Affected Software
Flynax Bridge [flynax-bridge]
Researcher
Affected Software
Foodbakery Sticky Cart [foodbakery-sticky-cart]
Researcher
Affected Software
Grace Mag [grace-mag]
Researcher
Affected Software
Grand Conference | Event WordPress [grandconference]
Researcher
Affected Software
Grand Restaurant WordPress [grandrestaurant]
Researcher
Affected Software
Grand Restaurant WordPress [grandrestaurant]
Researcher
Affected Software
Hospital Management System for Wordpress [hospital-management]
Researcher
Affected Software
License For Envato [license-envato]
Researcher
Affected Software
Opstore [opstore]
Researcher
Affected Software
Product Lister for eBay [product-lister-ebay]
Researcher
Affected Software
Service Finder Bookings [sf-booking]
Researcher
Affected Software
SEUR Oficial [seur]
Researcher
Affected Software
Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light [excel-like-price-change-for-woocommerce-and-wp-e-commerce-light]
Researcher
Affected Software
SUMO Reward Points for WooCommerce [rewardsystem]
Researcher
Affected Software
WP Foodbakery [wp-foodbakery]
Researcher
Affected Software
Xews Lite [xews-lite]
Researcher
Affected Software
Database Toolset [database-toolset]
Researcher
Affected Software
Aeropage Sync for Airtable [aeropage-sync-for-airtable]
Researcher
Affected Software
BM Content Builder [bm-builder]
Researcher
Affected Software
Configurator Theme Core [amz-configurator-core]
Researcher
Affected Software
Crossword Compiler Puzzles [crossword-compiler-puzzles]
Researcher
Affected Software
Login, Registration and Lost Password Blocks [frontend-login-and-registration-blocks]
Researcher
Affected Software
Greenshift – animation and page builder blocks [greenshift-animation-and-page-builder-blocks]
Researcher
Affected Software
Integração entre Eduzz e Woocommerce [integracao-entre-eduzz-e-wc-powers]
Researcher
My Tickets – Accessible Event Ticketing <= 2.0.16 - Authenticated (Subscriber+) Privilege Escalation
8.8
Affected Software
My Tickets – Accessible Event Ticketing [my-tickets]
Researcher
Affected Software
Easy Notify Lite [easy-notify-lite]
Researcher
Affected Software
PowerPress Podcasting plugin by Blubrry [powerpress]
Researcher
Affected Software
Xelion Webchat [xelion-webchat]
Researcher
Affected Software
Xpro Elementor Addons - Pro [xpro-elementor-addons-pro]
Researcher
Affected Software
Verification SMS with TargetSMS [verification-sms-targetsms]
Researcher
Affected Software
Grand Restaurant WordPress [grandrestaurant]
Researcher
Affected Software
Simple Shopping Cart [wordpress-simple-paypal-shopping-cart]
Researcher
Affected Software
Researcher
Affected Software
JobSearch WP Job Board [wp-jobsearch]
Researcher
Affected Software
Jupiter X Core [jupiterx-core]
Researcher
Affected Software
Plugin Central [plugin-central]
Researcher
Affected Software
AnalyticsWP [analyticswp]
Researcher
Affected Software
WordPress Easy Guide [wp-easy-guide]
Researcher
Affected Software
Fable Extra [fable-extra]
Researcher
Affected Software
Frontend Dashboard [frontend-dashboard]
Researcher
Affected Software
Hospital Management System for Wordpress [hospital-management]
Researcher
Affected Software
Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin [majestic-support]
Researcher
Affected Software
Mayosis Core [mayosis-core]
Researcher
Affected Software
Simple Shopping Cart [wordpress-simple-paypal-shopping-cart]
Researcher
Affected Software
WP HRM LITE [wp-hrm-lite-human-resource-management-system]
Researcher
Affected Software
Researcher
Affected Software
Add custom page template [add-custom-page-template]
Researcher
Affected Software
eForm - WordPress Form Builder [wp-fsqm-pro]
Researcher
Affected Software
Flickr Shortcode Importer [flickr-shortcode-importer]
Researcher
Affected Software
WPMasterToolKit (WPMTK) – All in one plugin [wpmastertoolkit]
Researcher
Affected Software
Social Counter & Sharer [social-counter]
Researcher
Affected Software
Researcher
Affected Software
Anps Theme plugin [anps_theme_plugin]
Researcher
Affected Software
Appointment Booking Calendar [appointment-booking-calendar]
Researcher
Affected Software
Appsero Helper [appsero-helper]
Researcher
Affected Software
ELEX WooCommerce Bulk Edit Products, Prices & Attributes (Basic) [elex-bulk-edit-products-prices-attributes-for-woocommerce-basic]
Researcher
Affected Software
FAT Services Booking [fat-services-booking]
Researcher
Affected Software
Hospital Management System for Wordpress [hospital-management]
Researcher
Affected Software
Mailing Group Listserv [wp-mailing-group]
Researcher
Affected Software
Ocean Extra [ocean-extra]
Researcher
Affected Software
ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin [woolentor-addons]
Researcher
Affected Software
Able Player, accessible HTML5 media player [ableplayer]
Researcher
Affected Software
Able Player, accessible HTML5 media player [ableplayer]
Researcher
Affected Software
Advanced Accordion Gutenberg Block – Create Beautiful FAQs, Content Accordions & Interactive Tabs [advanced-accordion-block]
Researcher
Affected Software
Animate [animate]
Researcher
Affected Software
Author Box After Posts [author-box-after-posts]
Researcher
Affected Software
Awesome Wp Image Gallery [awesome-wp-image-gallery]
Researcher
Affected Software
BBCode Deluxe [bbcode-deluxe]
Researcher
Affected Software
BeerXML Shortcode [beerxml-shortcode]
Researcher
Affected Software
Breeze Display [wt-display-breeze]
Researcher
Affected Software
Carousel-of-post-images [carousel-of-post-images]
Researcher
Affected Software
Kali Forms — Contact Form & Drag-and-Drop Builder [kali-forms]
Researcher
Affected Software
Custom Related Posts [custom-related-posts]
Researcher
Affected Software
Dropdown Content [dropdown-content]
Researcher
Affected Software
Element Pack – Widgets, Templates & Addons for Elementor [bdthemes-element-pack-lite]
Researcher
Affected Software
Enhanced Paypal Shortcodes [enhanced-paypal-shortcodes]
Researcher
Affected Software
Event Post [event-post]
Researcher
Affected Software
External Markdown [external-markdown]
Researcher
Affected Software
Fable Extra [fable-extra]
Researcher
Affected Software
Firelight Lightbox [easy-fancybox]
Researcher
Affected Software
FuseDesk [fusedesk]
Researcher
Affected Software
GNA Search Shortcode [gna-search-shortcode]
Researcher
Affected Software
GTDB Guitar Tuners [guitar-tuner]
Researcher
Affected Software
GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor [gutenkit-blocks-addon]
Researcher
Affected Software
HTML Forms – Simple WordPress Forms Plugin [html-forms]
Researcher
Affected Software
Image Hover Effects For WPBakery Page Builder [image-hover-effects-for-visual-composer]
Researcher
Affected Software
Image Style Hover – Displays content when you hover on image [image-content-show-hover]
Researcher
Affected Software
Inline Text Popup [inline-text-popup]
Researcher
Affected Software
LightPress Lightbox [wp-jquery-lightbox]
Researcher
Affected Software
Link Library [link-library]
Researcher
Affected Software
List Last Changes [list-last-changes]
Researcher
Affected Software
Embed Lottie Player – Add Interactive Lottie Animations with Block Support [embed-lottie-player]
Researcher
Affected Software
Mad Mimi for WordPress [mad-mimi]
Researcher
Affected Software
Mini twitter feed [mini-twitter-feed]
Researcher
Affected Software
Mixcloud Embed [mixcloud-embed]
Researcher
Affected Software
MPL-Publisher — Ebook & Audiobook Creator [mpl-publisher]
Researcher
Affected Software
Multi-Column Taxonomy List [multi-column-taxonomy-list]
Researcher
Affected Software
Nepali Post Date [nepali-post-date]
Researcher
Affected Software
Ocean Extra [ocean-extra]
Researcher
Affected Software
Ocean Extra [ocean-extra]
Researcher
Affected Software
Peadig’s Google +1 Button [google-1]
Researcher
Affected Software
Post in page for Elementor [post-in-page-for-elementor]
Researcher
Affected Software
Posts for Page [posts-for-page]
Researcher
Responsive Lightbox & Gallery <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
Responsive Lightbox & Gallery [responsive-lightbox]
Researcher
Affected Software
Simple Download Counter [simple-download-counter]
Researcher
Affected Software
Simple Google Photos Grid [simple-google-photos-grid]
Researcher
Affected Software
Simple Lightbox [simple-lightbox]
Researcher
Affected Software
Researcher
Affected Software
SKT Blocks – Gutenberg based Page Builder [skt-blocks]
Researcher
Affected Software
Sky Addons for Elementor [sky-elementor-addons]
Researcher
Affected Software
Tax Switch for WooCommerce [tax-switch-for-woocommerce]
Researcher
Affected Software
The Pack Elementor addon [the-pack-addon]
Researcher
Affected Software
Theme Switcha – Easily Switch Themes for Development and Testing [theme-switcha]
Researcher
Affected Software
WordPress Tooltip [wp-tooltip]
Researcher
Affected Software
UiCore Elements – Free widgets and templates for Elementor [uicore-elements]
Researcher
Affected Software
Visual Composer Website Builder [visualcomposer]
Researcher
Affected Software
WoWHead Tooltips [wowhead-tooltips]
Researcher
Affected Software
Researcher
Affected Software
WP Custom Post Popup [custom-post-popup]
Researcher
WP Import Export Lite <= 3.9.27 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
6.4
Affected Software
WP Import Export Lite [wp-import-export-lite]
Researcher
Affected Software
Best Quiz Plugin for WordPress: WP Quiz [wp-quiz]
Researcher
Affected Software
Zoho Creator Forms [zohocreator]
Researcher
Affected Software
1 Decembrie 1918 [1-decembrie-1918]
Researcher
Affected Software
ACF: Google Font Selector [acf-google-font-selector-field]
Researcher
Affected Software
Add Google +1 (Plus one) social share Button [add-google-plus-one-social-share-button]
Researcher
Affected Software
Advanced lazy load [advanced-lazy-load]
Researcher
Affected Software
Ajax Comment Form CST [ajax-comment-form-cst]
Researcher
Affected Software
Anything Popup [anything-popup]
Researcher
Affected Software
Best Posts Summary [best-posts-summary]
Researcher
Affected Software
Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools [woocommerce-jetpack]
Researcher
Affected Software
Contact Form 7 Calendar [cf7-calendar]
Researcher
Affected Software
Control Listings – Classifieds Ads Directory Portal Manager [control-listings]
Researcher
Affected Software
Custom Admin-Bar Favorites [admin-bookmarks]
Researcher
Affected Software
Custom Functions Plugin [custom-functions]
Researcher
Affected Software
Researcher
Affected Software
Google News [google-news]
Researcher
Affected Software
Hospital Management System for Wordpress [hospital-management]
Researcher
Affected Software
Libro de Reclamaciones [libro-de-reclamaciones]
Researcher
Affected Software
Loan Calculator [repayment-calculator]
Researcher
Affected Software
LSD Custom taxonomy and category meta [custom-taxonomy-category-and-term-fields]
Researcher
Milat jQuery Automatic Popup <= 1.3.1 - Cross-Site Request Forgery to Stored Cross-site Scripting
6.1
Affected Software
Milat jQuery Automatic Popup [milat-jquery-automatic-popup]
Researcher
Affected Software
My Custom Widgets [mycustomwidget]
Researcher
Affected Software
occupancyplan [occupancyplan]
Researcher
Related Posts via Taxonomies <= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
6.1
Affected Software
Related Posts via Taxonomies [related-posts-via-taxonomies]
Researcher
Affected Software
Tayori Form Plugin [tayori]
Researcher
Affected Software
Time Based Greeting [time-based-greeting]
Researcher
Affected Software
Twitter Card Generator [twitter-card-generator]
Researcher
Affected Software
Researcher
Affected Software
Vasaio QR Code [vasaio-qr-code]
Researcher
Affected Software
VikRestaurants Table Reservations and Take-Away [vikrestaurants]
Researcher
Affected Software
WordPress Events Calendar Registration & Tickets [wpeventplus]
Researcher
Affected Software
Wp Custom CMS Block [wp-custom-cms-block]
Researcher
Affected Software
WP Filter Post Category [wp-filter-post-categories]
Researcher
WpZon – Amazon Affiliate Plugin <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
6.1
Affected Software
WpZon – Amazon Affiliate Plugin [wpzon]
Researcher
Affected Software
Confirm User Registration [confirm-user-registration]
Researcher
Affected Software
Send From [send-from]
Researcher
Affected Software
WP Customize Login Page [wp-customize-login-page]
Researcher
Affected Software
Prevent Direct Access – Protect WordPress Files [prevent-direct-access]
Researcher
Affected Software
Print Science Designer [print-science-designer]
Researcher
Affected Software
Researcher
Affected Software
Appointment Booking Calendar [appointment-booking-calendar]
Researcher
Affected Software
Bulk Assign Linked Products For WooCommerce [wc-bulk-assign-linked-products]
Researcher
Affected Software
Researcher
Affected Software
Memberpress [memberpress]
Researcher
Affected Software
Prevent Direct Access – Protect WordPress Files [prevent-direct-access]
Researcher
Affected Software
Reales WP - Real Estate WordPress Theme [reales-wp-real-estate-wordpress-theme]
Researcher
Affected Software
Upsell Funnel Builder for WooCommerce – Create Upsells, Cross-Sells, Order Bumps, Frequently Bought, and Popups. [upsell-order-bump-offer-for-woocommerce]
Researcher
Affected Software
WP Customize Login Page [wp-customize-login-page]
Researcher
Affected Software
Researcher
Affected Software
Absolute Links [absolute-links]
Researcher
Affected Software
Researcher
Affected Software
iCafe Library [icafe-library]
Researcher
Affected Software
Message Filter for Contact Form 7 [cf7-message-filter]
Researcher
Affected Software
Watu Quiz [watu]
Researcher
Affected Software
Blog Manager WP [blog-manager-wp]
Researcher
Affected Software
Business Contact Widget [business-contact-widget]
Researcher
Affected Software
cookieBAR [cookiebar]
Researcher
Affected Software
COVID-19 (Coronavirus) Update Your Customers [covid-19-alert]
Researcher
Affected Software
Floating Social Bar [floating-social-bar]
Researcher
Affected Software
Landing pages and Domain aliases for WordPress [landing-pages-and-domain-aliases]
Researcher
Affected Software
Mang Board WP [mangboard]
Researcher
Affected Software
Seriously Simple Podcasting [seriously-simple-podcasting]
Researcher
Affected Software
Textmetrics [webtexttool]
Researcher
Affected Software
Researcher
Affected Software
WP Cookie Consent [wp-cookie-consent]
Researcher
Affected Software
WP-reCAPTCHA-bp [wp-recaptcha-bp]
Researcher
Affected Software
WS Force Login Page [ws-force-login-page]
Researcher
Affected Software
Aeropage Sync for Airtable [aeropage-sync-for-airtable]
Researcher
Affected Software
affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display [affiliate-toolkit-starter]
Researcher
Affected Software
All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier [aio-time-clock-lite]
Researcher
Affected Software
Author Box Plugin With Different Description [author-box-with-different-description]
Researcher
Affected Software
Availability Calendar [availability]
Researcher
Affected Software
Call Now PHT Blog [call-now-coccoc-pht-blog]
Researcher
Affected Software
Car Park Booking System for WordPress [car-park-booking-system-for-wordpress]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Custom Login and Registration [ms-registration]
Researcher
Affected Software
Researcher
Affected Software
Easy Child Theme Creator [easy-child-theme-creator]
Researcher
Affected Software
Evergreen Content Poster – Auto Post and Schedule Your Best Content to Social Media [evergreen-content-poster]
Researcher
Affected Software
Hacklog Remote Attachment [hacklog-remote-attachment]
Researcher
Affected Software
bellevuex [bellevuex]
Researcher
Affected Software
Media Library Downloader [media-library-downloader]
Researcher
Affected Software
Modern Polls [modern-polls]
Researcher
Affected Software
Navegg Analytics [navegg]
Researcher
Affected Software
PayPal Express Checkout [paypal-express-checkout]
Researcher
Affected Software
Premmerce Wholesale Pricing for WooCommerce [premmerce-woocommerce-wholesale-pricing]
Researcher
Affected Software
Recover abandoned cart for WooCommerce [recover-wc-abandoned-cart]
Researcher
Affected Software
SCSS-Library [scss-library]
Researcher
Affected Software
Simple calendar for Elementor [simple-calendar-for-elementor]
Researcher
Affected Software
Smart Hashtags [#hashtagger] [hashtagger]
Researcher
Affected Software
WordPress Tabs [gt-tabs]
Researcher
Affected Software
Unsafe Mimetypes [unsafe-mimetypes]
Researcher
Affected Software
Woocommerce Automatic Order Printing | ( Formerly WooCommerce Google Cloud Print) [xc-woo-google-cloud-print]
Researcher
Affected Software
wp-cyr-cho | Конвертира кирилски символи в латиниски [wp-cyr-cho]
Researcher
Affected Software
WPVN – Username Changer [wpvn-username-changer]
Researcher
Affected Software
Zalo Official Live Chat [zalo-official-live-chat]
Researcher
Affected Software
Buddypress Force Password Change [buddy-press-force-password-change]
Researcher
As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.
This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
Comments