Wordfence Intelligence Weekly WordPress Vulnerability Report (May 5, 2025 to May 11, 2025)
📢 In case you missed it, Wordfence just published its annual WordPress security report for 2024. Read it now to learn more about the evolving risk landscape of WordPress so you can keep your sites protected in 2025 and beyond.
Last week, there were 230 vulnerabilities disclosed in 211 WordPress Plugins and 3 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 69 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.
Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back.
Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 26,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
New Firewall Rules Deployed Last Week
The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.
The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:
- TheGem <= 5.10.3 – Authenticated (Subscriber+) Arbitrary File Upload
- WAF-RULE-827 – Data redacted while we work with the vendor on a patch.
- WAF-RULE-829 – Data redacted while we work with the vendor on a patch.
- WAF-RULE-830 – Data redacted while we work with the vendor on a patch.
- WAF-RULE-831 – Data redacted while we work with the vendor on a patch.
Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.
Total Unpatched & Patched Vulnerabilities Last Week
| Patch Status | Number of Vulnerabilities |
|---|---|
| Patched | 188 |
| Unpatched | 42 |
Total Vulnerabilities by CVSS Severity Last Week
| Severity Rating | Number of Vulnerabilities |
|---|---|
| Low Severity | 1 |
| Medium Severity | 171 |
| High Severity | 42 |
| Critical Severity | 16 |
Total Vulnerabilities by CWE Type Last Week
| Vulnerability Type by CWE | Number of Vulnerabilities |
|---|---|
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 80 |
| Cross-Site Request Forgery (CSRF) | 43 |
| Missing Authorization | 26 |
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | 12 |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 11 |
| Unrestricted Upload of File with Dangerous Type | 10 |
| Server-Side Request Forgery (SSRF) | 7 |
| Authorization Bypass Through User-Controlled Key | 6 |
| Deserialization of Untrusted Data | 6 |
| Improper Control of Generation of Code ('Code Injection') | 5 |
| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 5 |
| URL Redirection to Untrusted Site ('Open Redirect') | 4 |
| Authentication Bypass Using an Alternate Path or Channel | 3 |
| Exposure of Sensitive Information to an Unauthorized Actor | 3 |
| Improper Authorization | 3 |
| Improper Privilege Management | 2 |
| Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') | 1 |
| External Control of File Name or Path | 1 |
| Incorrect Authorization | 1 |
| Unverified Password Change | 1 |
Researchers That Contributed to WordPress Security Last Week
| Researcher Name | Number of Vulnerabilities |
|---|---|
| 37 | |
| 28 | |
| 16 | |
| 10 | |
| 10 | |
| 8 | |
| 7 | |
| 6 | |
| 6 | |
| 5 | |
| 5 | |
| 5 | |
| 4 | |
| 4 | |
| 4 | |
| 4 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.
WordPress Plugins with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| 1 Click Migration & Backup: Free WordPress Migration Plugin with Zero Downtime & Easy Clone | 1-click-migration |
| aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder | ablocks |
| Accept Donations with PayPal & Stripe | easy-paypal-donation |
| Activity Link Preview For BuddyPress | activity-link-preview-for-buddypress |
| Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution | file-manager-advanced |
| AHAthat Plugin | ahathat |
| AI Puffer – Chat. Create. Automate. (formerly AI Power) | gpt3-ai-content-generator |
| Ajar in5 Embed | ajar-productions-in5-embed |
| Ajax Load More – Infinite Scroll, Load More, & Lazy Load | ajax-load-more |
| Amazon Product in a Post Plugin | amazon-product-in-a-post-plugin |
| AWEOS WP Lock | aweos-wp-lock |
| Awesome Gallery | awesome-gallery |
| Awin – Advertiser Tracking for WooCommerce | awin-advertiser-tracking |
| Beacon Lead Magnets and Lead Capture | beacon-by |
| Beds24 Online Booking | beds24-online-booking |
| belingoGeo | belingogeo |
| Better Search – Relevant search results for WordPress | better-search |
| BlockSpare – Gutenberg Post Grid Blocks for News, Magazine & Blog Websites | blockspare |
| BMI Adult & Kid Calculator | bmi-adultkid-calculator |
| Bold Page Builder | bold-page-builder |
| BuddyBoss Platform Pro | buddyboss-platform-pro |
| Bulk Featured Image | bulk-featured-image |
| Calculate Prices based on Distance For WooCommerce | calculate-prices-based-on-distance-for-woocommerce |
| Captivate Sync | captivatesync-trade |
| CarDealerPress | cardealerpress |
| Cart tracking for WooCommerce | cart-tracking-for-woocommerce |
| CBX Map for Google Map & OpenStreetMap | cbxgooglemap |
| CC BMI Calculator | cc-bmi-calculator |
| Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More | charitable |
| Cision Block | cision-block |
| ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages | clickwhale |
| Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors | publishpress-authors |
| CoinPayments.net Payment Gateway for WooCommerce | coinpayments-payment-gateway-for-woocommerce |
| Color Your Bar | color-your-bar |
| Contact Form 7 – PayPal & Stripe Add-on | contact-form-7-paypal-add-on |
| Contact Form Widget | new-contact-form-widget |
| Content Control – The Ultimate Content Restriction Plugin! Restrict Content, Create Conditional Blocks & More | content-control |
| ContentStudio | contentstudio |
| Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe | contest-gallery |
| Contextual Related Posts | contextual-related-posts |
| Contribuinte Checkout | contribuinte-checkout |
| CookieCode | cookiecode |
| Cool Author Box – For Widget and Post Content | hm-cool-author-box-widget |
| Cost Calculator for Elementor | cost-calculator-for-elementor |
| Countdown Timer – Widget Countdown | widget-countdown |
| Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates | cozy-addons |
| Credova Financial | credova-financial |
| CSV Mass Importer | csv-mass-importer |
| Custom Checkout Fields for WooCommerce | custom-checkout-fields-for-woocommerce |
| DELUCKS SEO | delucks-seo |
| Depicter — Popup & Slider Builder | depicter |
| Display Eventbrite Events | widget-for-eventbrite-api |
| Display Remote Posts Block | display-remote-posts-block |
| DoFollow Case by Case | dofollow-case-by-case |
| Download Monitor | download-monitor |
| Drag and Drop Multiple File Upload for WooCommerce | drag-and-drop-multiple-file-upload-for-woocommerce |
| Dynamic Pricing With Discount Rules for WooCommerce | aco-woo-dynamic-pricing |
| Easy PayPal & Stripe Buy Now Button | wp-ecommerce-paypal |
| Easy PayPal Events & Tickets | easy-paypal-events-tickets |
| Easy Replace Image | easy-replace-image |
| EasyMe Connect | easyme-connect |
| Ebook Store | ebook-store |
| ELEX Product Feed for WooCommerce | elex-product-feed |
| ELEX WordPress HelpDesk & Customer Ticketing System | elex-helpdesk-customer-support-ticket-system |
| Email Notification on Login | email-notification-on-login |
| Envo Extra | envo-extra |
| Envolve Plugin | envolve-plugin |
| EU/UK VAT Validation Manager for WooCommerce | eu-vat-for-woocommerce |
| EUCookieLaw | eucookielaw |
| Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) | wp-event-solution |
| EventON – Events Calendar | eventon-lite |
| External image replace | external-image-replace |
| EZ Related Posts Footer Links and Widget | spostarbust |
| Frontend Dashboard | frontend-dashboard |
| FundEngine – Donation and Crowdfunding Platform | wp-fundraising-donation |
| FunnelCockpit | funnelcockpit |
| GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress | gamipress |
| Gearside Developer Dashboard | gearside-developer-dashboard |
| Graphina – Charts and Graphs For Elementor | graphina-elementor-charts-and-graphs |
| Groundhogg — CRM, Newsletters, and Marketing Automation | groundhogg |
| GS Variation Swatches for WooCommerce | gs-woo-variation-swatches |
| Guest posting / Frontend Posting / Front Editor – WP Front User Submit | front-editor |
| Hash Form – Drag & Drop Form Builder | hash-form |
| Hotel Booking | nd-booking |
| IMITHEMES Listing | imithemes-listing |
| Inline Related Posts | intelly-related-posts |
| Innovs WPBakery Visual Composer WHMCS Elements | void-visual-whmcs-element |
| Instantio — Side Cart & One-Page Checkout for WooCommerce | instantio |
| Integration for WooCommerce and Salesforce | woo-salesforce-plugin-crm-perks |
| Integrations of Zoho CRM with Elementor form | integrations-of-zoho-crm-with-elementor-form |
| Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress | jeg-elementor-kit |
| Jupiter X Core | jupiterx-core |
| LayoutBoxx | layoutboxx |
| Lead Form Data Collection to CRM | wp-leads-builder-any-crm |
| Legal Terms and Conditions Popup for User Login and WooCommerce Checkout | terms-popup-on-user-login |
| LessButtons Social Sharing and Statistics | lessbuttons |
| LexonAds: Free Ad Network – Boost Traffic, Ad Exchange & Get More Visitors | martins-free-and-easy-ad-network-get-more-visitors |
| List category posts | list-category-posts |
| Listamester | listamester |
| LiteSpeed Cache | litespeed-cache |
| LiveAgent – Omnichannel Help Desk & Live Chat Software | liveagent |
| LocateAndFilter | locateandfilter |
| Login Lockdown & Protection | login-lockdown |
| Login, Registration and Lost Password Blocks | frontend-login-and-registration-blocks |
| Logo Showcase – Logo Slider, Carousel & Sponsors Gallery | logo-showcase |
| Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails | mail-mint |
| Media Hygiene: Remove or Delete Unused Images and More! | media-hygiene |
| Meks Flexible Shortcodes | meks-flexible-shortcodes |
| Meow Gallery | meow-gallery |
| Min Max Step Quantity Limits Manager for WooCommerce | product-quantity-for-woocommerce |
| Mollie Forms | mollie-forms |
| Multiple Post Type Order | multiple-post-type-order |
| Music Player for WooCommerce | music-player-for-woocommerce |
| N360 | Splash Screen | n360-splash-screen |
| NEX-Forms – Ultimate Forms Plugin for WordPress | nex-forms-express-wp-form-builder |
| NGG Smart Image Search | ngg-smart-image-search |
| Number of Products per Page – Pagination Manager for WooCommerce | products-per-page-for-woocommerce |
| Open Close Store for WooCommerce – Business Hours Schedules Manager | woc-open-close |
| Ovation Elements | ovation-elements |
| Pays – WooCommerce Payment Gateway | axima-payment-gateway |
| PDF Invoice for WooCommerce + Drag and Drop Template Builder | pdf-for-woocommerce |
| PDF Invoices & Packing Slips for WooCommerce – Challan | webappick-pdf-invoice-for-woocommerce |
| PeproDev Ultimate Profile Solutions | peprodev-ups |
| PGS Core | pgs-core |
| Photo Gallery – GT3 Image Gallery & Gutenberg Block Gallery | gt3-photo-video-gallery |
| Poll Maker by AYS – Versus Polls, Anonymous Polls, Image Polls | poll-maker |
| Premmerce | premmerce |
| Premmerce Product Search for WooCommerce | premmerce-search |
| Premmerce User Roles | premmerce-user-roles |
| Product Quantity Dropdown For Woocommerce | product-quantity-dropdown-for-woocommerce |
| Product Time Countdown for WooCommerce | product-countdown-for-woocommerce |
| Productive Commerce – Wishlist, Compare, Quick View, & MiniCart | productive-commerce |
| Progress Bar | progress-bar |
| PSW Front-end Login & Registration | psw-login-and-registration |
| PW WooCommerce Bulk Edit | pw-bulk-edit |
| QS Dark Mode Plugin | qs-dark-mode |
| Quran multilanguage Text & Audio | quran-text-multilanguage |
| Reales WP STPT | short-tax-post |
| Really Simple Under Construction Page | really-simple-under-construction |
| Relevanssi Premium | relevanssi-premium |
| Relevanssi – A Better Search | relevanssi |
| Responsive Starter Templates – Elementor Templates & Starter Sites | responsive-add-ons |
| Robo Gallery – Photo & Image Slider | robo-gallery |
| Royal Addons for Elementor – Addons and Templates Kit for Elementor | royal-elementor-addons |
| RS WP Book Showcase – A Complete Book Catalogue & Library System | rs-wp-books-showcase |
| Search Exclude | search-exclude |
| SendPulse Email Marketing Newsletter | sendpulse-email-marketing-newsletter |
| Seznam Webmaster | seznam-webmaster |
| Show All Comments | show-all-comments-in-one-page |
| Sidebar Manager Light | sidebar-manager-light |
| Simple Blog Stats | simple-blog-stats |
| Simple calendar for Elementor | simple-calendar-for-elementor |
| Simple File List | simple-file-list |
| Simple Giveaways – Grow your business, email lists and traffic with contests | giveasap |
| SKT Skill Bar | skt-skill-bar |
| Smaily for WP | smaily-for-wp |
| SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery | sms-alert |
| Soccer Live Scores | soccer-live-scores |
| Solace Extra | solace-extra |
| Solid Testimonials – Testimonial Slider, Video Testimonials & Customer Reviews | gs-testimonial |
| Spiraclethemes Site Library | spiraclethemes-site-library |
| StoreKeeper for WooCommerce | storekeeper-for-woocommerce |
| Submission DOM tracking for Contact Form 7 | cf7-submission-dom-tracking |
| Supertext Translation and Proofreading | polylang-supertext |
| tagDiv Composer | td-composer |
| theMarketer – Email marketing, Newsletters, Automation & Loyalty for Woocommerce | themarketer |
| Time Clock – A WordPress Employee & Volunteer Time Clock Plugin | time-clock |
| TrackShip for WooCommerce | trackship-for-woocommerce |
| TrueBooker – Appointment Booking and Scheduler System | truebooker-appointment-booking |
| Ultimate Before After Image Slider & Gallery – BEAF | beaf-before-and-after-gallery |
| Ultimate Blocks – 25+ Gutenberg Blocks for Block Editor | ultimate-blocks |
| Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin | ultimate-member |
| Ultimate WP Mail | ultimate-wp-mail |
| Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin | uncanny-automator |
| User Login History | user-login-history |
| User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder | user-registration |
| Web Accessibility with Max Access | accessibility-toolbar |
| WebberZone Top 10 — Popular Posts | top-10 |
| WebinarPress – Webinar System for WordPress | wp-webinarsystem |
| Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode | coming-soon |
| weMail – Email Marketing, Newsletter Builder & Email Automations for WooCommerce | wemail |
| Wiki Embed | wiki-embed |
| Woobox | woobox |
| Woocommerce Multiple Addresses | woocommerce-multiple-addresses |
| WordPress Review Plugin: The Ultimate Solution for Building a Review Website | wp-review |
| WP Compress – Instant Performance & Speed Optimization | wp-compress-image-optimizer |
| WP Discord Invite | wp-discord-invite |
| WP DPE-GES | wp-dpe-ges |
| WP Gravity Forms Dynamics CRM | gf-dynamics-crm |
| WP Gravity Forms Zendesk | gf-zendesk |
| WP Hotel Booking | wp-hotel-booking |
| WP Job Portal – AI-Powered Recruitment System for Company or Job Board website | wp-job-portal |
| WP jQuery DataTable | wp-jquery-datatable |
| WP Maintenance | wp-maintenance |
| WP Pipes | wp-pipes |
| WP Podcasts Manager | wp-podcasts-manager |
| WP SEO Structured Data Schema | wp-seo-structured-data-schema |
| WP-CRM System – Manage Clients and Projects | wp-crm-system |
| WP-Recall – Registration, Profile, Commerce & More | wp-recall |
| WPAdverts – Classifieds Plugin | wpadverts |
| WPBookit | wpbookit |
| WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More | wpforms-lite |
| WPshop 2 – E-Commerce | wpshop |
| WPSmartPay – Payment Forms, Invoices, Donations & Subscriptions | smartpay |
| WPSpeed – WordPress Speed, Cache & Performance Optimization (Core Web Vitals, PageSpeed 100) | wpspeed |
| WZ Followed Posts – Display what visitors are reading | where-did-they-go-from-here |
| Xavin's List Subpages | xavins-list-subpages |
| xili-tidy-tags | xili-tidy-tags |
| XT Event Widget for Social Events | xt-facebook-events |
| YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports | yaysmtp |
| 워드프레스 결제 심플페이 – 우커머스 결제 플러그인 | pgall-for-woocommerce |
WordPress Themes with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| Blocksy | blocksy |
| Seil - A Responsive WordPress Blog Theme | seil |
| Wolmart | Multi-Vendor Marketplace WooCommerce Theme | wolmart |
Vulnerability Details
Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.
Affected Software
Ajar in5 Embed [ajar-productions-in5-embed]
Researcher
Affected Software
BuddyBoss Platform Pro [buddyboss-platform-pro]
Researcher
CoinPayments.net Payment Gateway for WooCommerce <= 1.0.17 - Unauthenticated PHP Object Injection
9.8
Affected Software
CoinPayments.net Payment Gateway for WooCommerce [coinpayments-payment-gateway-for-woocommerce]
Researcher
Affected Software
Drag and Drop Multiple File Upload for WooCommerce [drag-and-drop-multiple-file-upload-for-woocommerce]
Researcher
Affected Software
Envolve Plugin [envolve-plugin]
Researcher
Affected Software
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) [wp-event-solution]
Researcher
Affected Software
Frontend Dashboard [frontend-dashboard]
Researcher
Affected Software
Login, Registration and Lost Password Blocks [frontend-login-and-registration-blocks]
Researcher
Affected Software
IMITHEMES Listing [imithemes-listing]
Researcher
Affected Software
PeproDev Ultimate Profile Solutions [peprodev-ups]
Researcher
Affected Software
PGS Core [pgs-core]
Researcher
Affected Software
PSW Front-end Login & Registration [psw-login-and-registration]
Researcher
Affected Software
StoreKeeper for WooCommerce [storekeeper-for-woocommerce]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
PDF Invoices & Packing Slips for WooCommerce – Challan [webappick-pdf-invoice-for-woocommerce]
Researcher
Affected Software
Display Eventbrite Events [widget-for-eventbrite-api]
Researcher
Affected Software
Download Monitor [download-monitor]
Researcher
Affected Software
ELEX WordPress HelpDesk & Customer Ticketing System [elex-helpdesk-customer-support-ticket-system]
Researcher
Affected Software
EventON – Events Calendar [eventon-lite]
Researcher
Affected Software
External image replace [external-image-replace]
Researcher
Affected Software
Researcher
Affected Software
Hotel Booking [nd-booking]
Researcher
Affected Software
Lead Form Data Collection to CRM [wp-leads-builder-any-crm]
Researcher
Affected Software
Open Close Store for WooCommerce – Business Hours Schedules Manager [woc-open-close]
Researcher
Affected Software
Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors [publishpress-authors]
Researcher
Affected Software
Reales WP STPT [short-tax-post]
Researcher
Affected Software
Researcher
Affected Software
Woocommerce Multiple Addresses [woocommerce-multiple-addresses]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
WPAdverts – Classifieds Plugin [wpadverts]
Researcher
Affected Software
WPshop 2 – E-Commerce [wpshop]
Researcher
Affected Software
XT Event Widget for Social Events [xt-facebook-events]
Researcher
Affected Software
PeproDev Ultimate Profile Solutions [peprodev-ups]
Researcher
Affected Software
Captivate Sync [captivatesync-trade]
Researcher
Affected Software
Researcher
Affected Software
belingoGeo [belingogeo]
Researcher
Affected Software
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) [wp-event-solution]
Researcher
Affected Software
Graphina – Charts and Graphs For Elementor [graphina-elementor-charts-and-graphs]
Researcher
Affected Software
List category posts [list-category-posts]
Researcher
Affected Software
PGS Core [pgs-core]
Researcher
Affected Software
Productive Commerce – Wishlist, Compare, Quick View, & MiniCart [productive-commerce]
Researcher
Affected Software
Depicter — Popup & Slider Builder [depicter]
Researcher
Affected Software
Researcher
Affected Software
LayoutBoxx [layoutboxx]
Researcher
Affected Software
PGS Core [pgs-core]
Researcher
Affected Software
Researcher
Affected Software
Ultimate Before After Image Slider & Gallery – BEAF [beaf-before-and-after-gallery]
Researcher
Affected Software
CSV Mass Importer [csv-mass-importer]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Activity Link Preview For BuddyPress [activity-link-preview-for-buddypress]
Researcher
Affected Software
Researcher
Affected Software
WP Maintenance [wp-maintenance]
Researcher
Affected Software
WP-CRM System – Manage Clients and Projects [wp-crm-system]
Researcher
Affected Software
Researcher
Affected Software
Ultimate WP Mail [ultimate-wp-mail]
Researcher
Affected Software
Researcher
Affected Software
Ajax Load More – Infinite Scroll, Load More, & Lazy Load [ajax-load-more]
Researcher
Affected Software
Awesome Gallery [awesome-gallery]
Researcher
Affected Software
Beds24 Online Booking [beds24-online-booking]
Researcher
Affected Software
Better Search – Relevant search results for WordPress [better-search]
Researcher
Affected Software
Researcher
Affected Software
Bold Page Builder [bold-page-builder]
Researcher
Affected Software
CarDealerPress [cardealerpress]
Researcher
Affected Software
CBX Map for Google Map & OpenStreetMap [cbxgooglemap]
Researcher
Affected Software
CC BMI Calculator [cc-bmi-calculator]
Researcher
Cision Block <= 4.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
6.4
Affected Software
Cision Block [cision-block]
Researcher
Affected Software
Researcher
Affected Software
Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe [contest-gallery]
Researcher
Affected Software
Contextual Related Posts [contextual-related-posts]
Researcher
Cost Calculator for Elementor <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
Cost Calculator for Elementor [cost-calculator-for-elementor]
Researcher
Affected Software
DELUCKS SEO [delucks-seo]
Researcher
Affected Software
Display Remote Posts Block [display-remote-posts-block]
Researcher
Affected Software
Easy Replace Image [easy-replace-image]
Researcher
Affected Software
Ebook Store [ebook-store]
Researcher
Affected Software
Inline Related Posts [intelly-related-posts]
Researcher
Affected Software
Researcher
Affected Software
Jupiter X Core [jupiterx-core]
Researcher
Affected Software
Logo Showcase – Logo Slider, Carousel & Sponsors Gallery [logo-showcase]
Researcher
Affected Software
Meks Flexible Shortcodes [meks-flexible-shortcodes]
Researcher
Affected Software
Meow Gallery [meow-gallery]
Researcher
Affected Software
Mollie Forms [mollie-forms]
Researcher
Affected Software
Custom Checkout Fields for WooCommerce [custom-checkout-fields-for-woocommerce]
Number of Products per Page – Pagination Manager for WooCommerce [products-per-page-for-woocommerce]
EU/UK VAT Validation Manager for WooCommerce [eu-vat-for-woocommerce]
Min Max Step Quantity Limits Manager for WooCommerce [product-quantity-for-woocommerce]
Researcher
Affected Software
Multiple Post Type Order [multiple-post-type-order]
Researcher
Affected Software
NEX-Forms – Ultimate Forms Plugin for WordPress [nex-forms-express-wp-form-builder]
Researcher
Affected Software
NGG Smart Image Search [ngg-smart-image-search]
Researcher
Affected Software
Photo Gallery – GT3 Image Gallery & Gutenberg Block Gallery [gt3-photo-video-gallery]
Researcher
Affected Software
Product Time Countdown for WooCommerce [product-countdown-for-woocommerce]
Researcher
Affected Software
Progress Bar [progress-bar]
Researcher
Affected Software
Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons]
Researcher
Affected Software
RS WP Book Showcase – A Complete Book Catalogue & Library System [rs-wp-books-showcase]
Researcher
Affected Software
SendPulse Email Marketing Newsletter [sendpulse-email-marketing-newsletter]
Researcher
Affected Software
Simple Blog Stats [simple-blog-stats]
Researcher
Affected Software
SKT Skill Bar [skt-skill-bar]
Researcher
Affected Software
Researcher
Affected Software
Solace Extra [solace-extra]
Researcher
Affected Software
Spiraclethemes Site Library [spiraclethemes-site-library]
Researcher
Affected Software
WebberZone Top 10 — Popular Posts [top-10]
Researcher
Affected Software
Ultimate Blocks – 25+ Gutenberg Blocks for Block Editor [ultimate-blocks]
Researcher
Affected Software
User Login History [user-login-history]
Researcher
Affected Software
Countdown Timer – Widget Countdown [widget-countdown]
Researcher
Affected Software
Woobox [woobox]
Researcher
Affected Software
WP DPE-GES [wp-dpe-ges]
Researcher
Affected Software
WP SEO Structured Data Schema [wp-seo-structured-data-schema]
Researcher
Affected Software
Innovs WPBakery Visual Composer WHMCS Elements [void-visual-whmcs-element]
Researcher
Affected Software
WZ Followed Posts – Display what visitors are reading [where-did-they-go-from-here]
Researcher
Affected Software
Xavin's List Subpages [xavins-list-subpages]
Researcher
Affected Software
NEX-Forms – Ultimate Forms Plugin for WordPress [nex-forms-express-wp-form-builder]
Researcher
Accept Donations with PayPal <= 1.4.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
6.1
Affected Software
Accept Donations with PayPal & Stripe [easy-paypal-donation]
Researcher
Affected Software
BMI Adult & Kid Calculator [bmi-adultkid-calculator]
Researcher
Affected Software
Contribuinte Checkout [contribuinte-checkout]
Researcher
Affected Software
EZ Related Posts Footer Links and Widget [spostarbust]
Researcher
Affected Software
FunnelCockpit [funnelcockpit]
Researcher
Affected Software
Gearside Developer Dashboard [gearside-developer-dashboard]
Researcher
Affected Software
Integration for WooCommerce and Salesforce [woo-salesforce-plugin-crm-perks]
Researcher
Affected Software
Integrations of Zoho CRM with Elementor form [integrations-of-zoho-crm-with-elementor-form]
Researcher
Researcher
Affected Software
tagDiv Composer [td-composer]
Researcher
Affected Software
Researcher
Affected Software
WP Gravity Forms Dynamics CRM [gf-dynamics-crm]
Researcher
Affected Software
WP Gravity Forms Zendesk [gf-zendesk]
Researcher
Affected Software
xili-tidy-tags [xili-tidy-tags]
Researcher
Affected Software
EUCookieLaw [eucookielaw]
Researcher
Affected Software
DoFollow Case by Case [dofollow-case-by-case]
Researcher
Affected Software
LiteSpeed Cache [litespeed-cache]
Researcher
Affected Software
Really Simple Under Construction Page [really-simple-under-construction]
Researcher
Affected Software
WebinarPress – Webinar System for WordPress [wp-webinarsystem]
Researcher
Affected Software
Login Lockdown & Protection [login-lockdown]
Researcher
Affected Software
Media Hygiene: Remove or Delete Unused Images and More! [media-hygiene]
Researcher
Affected Software
Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons]
Researcher
Affected Software
Supertext Translation and Proofreading [polylang-supertext]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
WPshop 2 – E-Commerce [wpshop]
Researcher
Affected Software
Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution [file-manager-advanced]
Researcher
Affected Software
Researcher
Affected Software
Envolve Plugin [envolve-plugin]
Researcher
Affected Software
Responsive Starter Templates – Elementor Templates & Starter Sites [responsive-add-ons]
Researcher
Affected Software
LocateAndFilter [locateandfilter]
Researcher
Affected Software
Researcher
Affected Software
PeproDev Ultimate Profile Solutions [peprodev-ups]
Researcher
Affected Software
Researcher
Affected Software
Reales WP STPT [short-tax-post]
Researcher
Affected Software
Search Exclude [search-exclude]
Researcher
Affected Software
Simple File List [simple-file-list]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Cart tracking for WooCommerce [cart-tracking-for-woocommerce]
Researcher
Affected Software
Dynamic Pricing With Discount Rules for WooCommerce [aco-woo-dynamic-pricing]
Researcher
Affected Software
ELEX Product Feed for WooCommerce [elex-product-feed]
Researcher
Affected Software
PDF Invoice for WooCommerce + Drag and Drop Template Builder [pdf-for-woocommerce]
Researcher
Affected Software
TrackShip for WooCommerce [trackship-for-woocommerce]
Researcher
Affected Software
Researcher
Affected Software
Amazon Product in a Post Plugin [amazon-product-in-a-post-plugin]
Researcher
Affected Software
AWEOS WP Lock [aweos-wp-lock]
Researcher
Affected Software
Bold Page Builder [bold-page-builder]
Researcher
Affected Software
Researcher
Affected Software
Color Your Bar [color-your-bar]
Researcher
Affected Software
Contact Form 7 – PayPal & Stripe Add-on [contact-form-7-paypal-add-on]
Researcher
Affected Software
CookieCode [cookiecode]
Researcher
Affected Software
Easy PayPal & Stripe Buy Now Button [wp-ecommerce-paypal]
Researcher
Email Notification on Login <= 1.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
Affected Software
Email Notification on Login [email-notification-on-login]
Researcher
Affected Software
Legal Terms and Conditions Popup for User Login and WooCommerce Checkout [terms-popup-on-user-login]
Researcher
Affected Software
N360 | Splash Screen [n360-splash-screen]
Researcher
Affected Software
Premmerce Product Search for WooCommerce [premmerce-search]
Researcher
Affected Software
Premmerce User Roles [premmerce-user-roles]
Researcher
Affected Software
Quran multilanguage Text & Audio [quran-text-multilanguage]
Researcher
Affected Software
Robo Gallery – Photo & Image Slider [robo-gallery]
Researcher
Affected Software
Show All Comments [show-all-comments-in-one-page]
Researcher
Affected Software
Submission DOM tracking for Contact Form 7 [cf7-submission-dom-tracking]
Researcher
Affected Software
Researcher
Affected Software
WP Discord Invite [wp-discord-invite]
Researcher
Affected Software
Researcher
Affected Software
WP jQuery DataTable [wp-jquery-datatable]
Researcher
Affected Software
AHAthat Plugin [ahathat]
Researcher
Affected Software
Awin – Advertiser Tracking for WooCommerce [awin-advertiser-tracking]
Researcher
Affected Software
Beacon Lead Magnets and Lead Capture [beacon-by]
Researcher
Affected Software
Bulk Featured Image [bulk-featured-image]
Researcher
Affected Software
Calculate Prices based on Distance For WooCommerce [calculate-prices-based-on-distance-for-woocommerce]
Researcher
Affected Software
Researcher
Affected Software
Contact Form Widget [new-contact-form-widget]
Researcher
Affected Software
ContentStudio [contentstudio]
Researcher
Affected Software
Cool Author Box – For Widget and Post Content [hm-cool-author-box-widget]
Researcher
Affected Software
Credova Financial [credova-financial]
Researcher
Affected Software
DoFollow Case by Case [dofollow-case-by-case]
Researcher
Affected Software
Researcher
Affected Software
Easy PayPal Events & Tickets [easy-paypal-events-tickets]
Researcher
Affected Software
EasyMe Connect [easyme-connect]
Researcher
Affected Software
Envo Extra [envo-extra]
Researcher
Affected Software
AI Puffer – Chat. Create. Automate. (formerly AI Power) [gpt3-ai-content-generator]
Researcher
Affected Software
Graphina – Charts and Graphs For Elementor [graphina-elementor-charts-and-graphs]
Researcher
Affected Software
Researcher
Affected Software
GS Variation Swatches for WooCommerce [gs-woo-variation-swatches]
Researcher
Affected Software
Hash Form – Drag & Drop Form Builder [hash-form]
Researcher
Affected Software
LessButtons Social Sharing and Statistics [lessbuttons]
Researcher
Affected Software
Listamester [listamester]
Researcher
Affected Software
Researcher
Affected Software
LexonAds: Free Ad Network – Boost Traffic, Ad Exchange & Get More Visitors [martins-free-and-easy-ad-network-get-more-visitors]
Researcher
Affected Software
Music Player for WooCommerce [music-player-for-woocommerce]
Researcher
Affected Software
Ovation Elements [ovation-elements]
Researcher
Affected Software
Pays – WooCommerce Payment Gateway [axima-payment-gateway]
Researcher
Affected Software
Premmerce [premmerce]
Researcher
Affected Software
Premmerce Product Search for WooCommerce [premmerce-search]
Researcher
Affected Software
Product Quantity Dropdown For Woocommerce [product-quantity-dropdown-for-woocommerce]
Researcher
Affected Software
PW WooCommerce Bulk Edit [pw-bulk-edit]
Researcher
Affected Software
QS Dark Mode Plugin [qs-dark-mode]
Researcher
Affected Software
Seznam Webmaster [seznam-webmaster]
Researcher
Affected Software
Sidebar Manager Light [sidebar-manager-light]
Researcher
Affected Software
Simple calendar for Elementor [simple-calendar-for-elementor]
Researcher
Affected Software
Researcher
Affected Software
Smaily for WP [smaily-for-wp]
Researcher
Affected Software
Soccer Live Scores [soccer-live-scores]
Researcher
Affected Software
TrueBooker – Appointment Booking and Scheduler System [truebooker-appointment-booking]
Researcher
Affected Software
Ultimate WP Mail [ultimate-wp-mail]
Researcher
Affected Software
Web Accessibility with Max Access [accessibility-toolbar]
Researcher
Affected Software
Researcher
Affected Software
Wiki Embed [wiki-embed]
Researcher
Affected Software
WP Compress – Instant Performance & Speed Optimization [wp-compress-image-optimizer]
Researchers
Affected Software
FundEngine – Donation and Crowdfunding Platform [wp-fundraising-donation]
Researcher
Affected Software
WP Hotel Booking [wp-hotel-booking]
Researcher
Affected Software
WP Podcasts Manager [wp-podcasts-manager]
Researcher
Affected Software
Researcher
Affected Software
워드프레스 결제 심플페이 – 우커머스 결제 플러그인 [pgall-for-woocommerce]
Researcher
Affected Software
Blocksy [blocksy]
Researcher
As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.
This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
Comments