Wordfence Intelligence Weekly WordPress Vulnerability Report (June 9, 2025 to June 15, 2025)
📢 Calling all Vulnerability Researchers and Bug Bounty Hunters! 📢Â
🌞 Spring into Summer with Wordfence! Now through August 4, 2025, earn 2X bounty rewards for all in-scope submissions from our ‘High Threat’ list in software with fewer than 5 million active installs. Bounties up to $31,200 per vulnerability. Submit bold. Earn big!
Last week, there were 156 vulnerabilities disclosed in 116 WordPress Plugins and 121 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 57 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.
Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back.
Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 27,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
New Firewall Rules Deployed Last Week
The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.
The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:
- PayU CommercePro Plugin <= 3.8.5 – Authentication Bypass
- WAF-RULE-845 – Data redacted while we work with the vendor on a patch.
- WAF-RULE-846 – Data redacted while we work with the vendor on a patch.
- WAF-RULE-847 – Data redacted while we work with the vendor on a patch.
- WAF-RULE-848 – Data redacted while we work with the vendor on a patch.
- WAF-RULE-852 – Data redacted while we work with the vendor on a patch.
Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.
Total Unpatched & Patched Vulnerabilities Last Week
| Patch Status | Number of Vulnerabilities |
|---|---|
| Patched | 103 |
| Unpatched | 53 |
Total Vulnerabilities by CVSS Severity Last Week
| Severity Rating | Number of Vulnerabilities |
|---|---|
| Medium Severity | 85 |
| High Severity | 32 |
| Critical Severity | 39 |
Total Vulnerabilities by CWE Type Last Week
| Vulnerability Type by CWE | Number of Vulnerabilities |
|---|---|
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 49 |
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | 32 |
| Missing Authorization | 15 |
| Cross-Site Request Forgery (CSRF) | 12 |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 12 |
| Unrestricted Upload of File with Dangerous Type | 12 |
| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 6 |
| Deserialization of Untrusted Data | 5 |
| Improper Privilege Management | 4 |
| Exposure of Sensitive Information to an Unauthorized Actor | 2 |
| Absolute Path Traversal | 1 |
| Authentication Bypass Using an Alternate Path or Channel | 1 |
| External Control of File Name or Path | 1 |
| Improper Control of Generation of Code ('Code Injection') | 1 |
| Incorrect Authorization | 1 |
| Server-Side Request Forgery (SSRF) | 1 |
| URL Redirection to Untrusted Site ('Open Redirect') | 1 |
Researchers That Contributed to WordPress Security Last Week
| Researcher Name | Number of Vulnerabilities |
|---|---|
| 19 | |
| 13 | |
| 11 | |
| 8 | |
| 8 | |
| 7 | |
| 6 | |
| 6 | |
| 4 | |
| 4 | |
| 4 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.
WordPress Plugins with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| Abandoned Cart Pro for WooCommerce | woocommerce-abandon-cart-pro |
| ACF Onyx Poll | acf-onyx-poll |
| Advanced Sermons | advanced-sermons |
| Advanced Settings 3 | advanced-settings |
| Aeroscroll Gallery – Infinite Scroll Image Gallery & Post Grid with Photo Gallery | aeroscroll-gallery |
| AFS Analytics | addfreestats |
| AI Image Lab – Free AI Image Generator | ai-image-generator-lab |
| Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin | simply-schedule-appointments |
| Arconix FAQ | arconix-faq |
| Arconix Shortcodes | arconix-shortcodes |
| Auto Attachments | auto-attachments |
| AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress | automatorwp |
| Axle Demo Importer | axle-demo-importer |
| Bunny’s Print CSS | bunnys-print-css |
| CLEVER - HTML5 Radio Player With History - Shoutcast and Icecast - WordPress Plugin | lbg-audio11-html5-shoutcast_history |
| Click to Chat – HoliThemes | click-to-chat-for-whatsapp |
| Color Palette | color-palette |
| Contact Form Plugin | contact-form-lite |
| Contact Us Page – Contact People | contact-us-page-contact-people |
| CubeWP Forms | cubewp-forms |
| CubeWP Framework | cubewp-framework |
| Digital Marketing and Agency Templates Addons for Elementor | digital-marketing-agency-templates-for-elementor |
| DIOT SCADA with MQTT | ecava-diot-scada |
| Easy Flashcards | easy-flashcards |
| Ebook Store | ebook-store |
| eForm - WordPress Form Builder | wp-fsqm-pro |
| Elementor Website Builder Pro | elementor-pro |
| Elite Video Player | elite-video-player |
| File Manager Pro – Filester | filester |
| flexo-posts-manager | flexo-posts-manager |
| flexoslider | flexoslider |
| FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce | wp-marketing-automations |
| FW Food Menu – Responsive food menu with ordering & delivery solutions | fw-food-menu |
| FW Gallery – Photo, video, audio media presentation and management system with players and slideshow | fw-gallery |
| Game Review Block | game-review-block |
| Hydra Booking — Appointment Scheduling & Booking Calendar | hydra-booking |
| If-So Dynamic Content – Elementor & All Page Builders Personalization | if-so |
| Image Resizer On The Fly | image-resizer-on-the-fly |
| IndieBlocks | indieblocks |
| IRM Newsroom | irm-newsroom |
| Kama Click Counter | kama-clic-counter |
| kk Youtube Video | kk-youtube-video |
| Link Shield | link-shield |
| Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin | majestic-support |
| Malcure Malware Shield — Removal, Repair, Monitor | wp-malware-removal |
| MapSVG | mapsvg |
| Meks Flexible Shortcodes | meks-flexible-shortcodes |
| Membership For WooCommerce | membership-for-woocommerce |
| MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions | dc-woocommerce-multi-vendor |
| Nasa Core | nasa-core |
| One-Login | one-login |
| Ovatheme Events Manager | ova-events-manager |
| Partial Shipment for Woocommerce | wc-partial-shipment |
| Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred | mycred |
| PostaPanduri | postapanduri |
| Premium Addons for Elementor – Powerful Elementor Templates & Widgets | premium-addons-for-elementor |
| Premmerce User Roles | premmerce-user-roles |
| Private Post Share | sharable-password-protected-posts |
| ProfileGrid – User Profiles, Groups and Communities | profilegrid-user-profiles-groups-and-communities |
| PT Luxa Addons | pt-luxa-addons |
| ReFormer – Multichannel Contact Form for Elementor | reformer-elementor |
| Responsive Blocks – Page Builder for Blocks & Patterns | responsive-block-editor-addons |
| Responsive Plus – Elementor Templates & Starter Sites | responsive-add-ons |
| REST API | Custom API Generator For Cross Platform And Import Export In WP | import-export-with-custom-rest-api |
| Restrict File Access | restrict-file-access |
| School Management System for Wordpress | school-management |
| Seriously Simple Podcasting | seriously-simple-podcasting |
| Simple Newsletter Plugin – Noptin | newsletter-optin-box |
| Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider | ml-slider |
| Slim SEO – A Fast & Automated SEO Plugin For WordPress | slim-seo |
| Smart Notification Wordpress Plugin. Web & Mobile Push, FB Messenger, FB Notifications & Newsletter. | smio-push-notification |
| Smash Balloon Social Post Feed – Simple Social Feeds for WordPress | custom-facebook-feed |
| StreamWeasels Kick Integration | streamweasels-kick-integration |
| Telegram for WP | telegram-for-wp |
| The Events Calendar | the-events-calendar |
| TicketBAI Facturas para WooCommerce | wp-ticketbai |
| Track, Analyze & Optimize by WP Tao | wp-tao |
| Traffic Monitor | traffic-monitor |
| Ultimate Blocks – 25+ Gutenberg Blocks for Block Editor | ultimate-blocks |
| Ultimate Reviews | ultimate-reviews |
| UserPro - Community and User Profile WordPress Plugin | userpro |
| Widget Logic | widget-logic |
| WidgetKit Pro | widgetkit-pro |
| WooCommerce Designer Pro | wc-designer-pro |
| WordPress Automatic Plugin | wp-automatic |
| WordPress Single Sign-On (SSO) - Multisite All-Inclusive | miniorange-oauth-oidc-single-sign-on |
| WordPress Single Sign-On (SSO) - Multisite Enterprise | miniorange-oauth-oidc-single-sign-on |
| WordPress Single Sign-On (SSO) - Multisite Premium | miniorange-oauth-oidc-single-sign-on |
| WordPress Single Sign-On (SSO) - Single Site All-Inclusive | miniorange-oauth-oidc-single-sign-on |
| WordPress Single Sign-On (SSO) - Single Site Enterprise | miniorange-oauth-oidc-single-sign-on |
| WordPress Single Sign-On (SSO) - Single Site Premium | miniorange-oauth-oidc-single-sign-on |
| WordPress Single Sign-On (SSO) - Single Site Standard | miniorange-oauth-oidc-single-sign-on |
| Workreap | workreap |
| WP Employee Attendance System | wp-employee-attendance-system |
| WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce | wp-event-manager |
| WP Job Portal – AI-Powered Recruitment System for Company or Job Board website | wp-job-portal |
| WP Lightbox 2 | wp-lightbox-2 |
| WP Sliding Login/Dashboard Panel | wp-sliding-logindashboard-panel |
| WP Travel Engine – Tour Booking Plugin – Tour Operator Software | wp-travel-engine |
| WP URL Shortener | wp-url-shortener |
| WP Views Counter | wpecounter |
| WP VR – 360 Panorama and Virtual Tour Builder | wpvr |
| WP Wizard Cloak | wp-wizard-cloak |
| WP-DownloadManager | wp-downloadmanager |
| WP2HTML | wp2html |
| WP2LEADS | WordPress und KlickTipp einfach verbinden – WooCommerce und KlickTipp einfach verbinden | wp2leads |
| WPAdverts – Classifieds Plugin | wpadverts |
| WPCRM - CRM for Contact form CF7 & WooCommerce | wpcrm |
| WPGYM - Wordpress Gym Management System | gym-management |
| WSMS (formerly WP SMS) – SMS & MMS Notifications with OTP and 2FA for WooCommerce | wp-sms |
| Xagio SEO – AI Powered SEO | xagio-seo |
| XiSearch bar | xisearch-bar |
| YITH WooCommerce Wishlist | yith-woocommerce-wishlist |
| Yougler Blogger Profile Page | yougler-blogger-profile-page |
| Zen Sticky Social | zen-social-sticky |
| Zotpress | zotpress |
WordPress Themes with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| 69 Clothing | Brand Store & Fashion Boutique WordPress Theme | clothing69 |
| A.Williams | Assistant & Administrative Services WordPress Theme | alisha-williams |
| Abogado - Lawyer WordPress Theme | abogado |
| Accalia | Dermatology Clinic & Cosmetology WordPress Theme + Elementor | accalia |
| Adrena | Airsoft Club & Paintball WordPress Theme | adrena |
| Advice - Psychology, Therapy & Counseling Theme | advice |
| Agora — Event & Conference WordPress Theme | agora |
| AI ANN - AI Generator & AI Agency WordPress Theme | ann |
| Alanzo | Chef & Event Catering WordPress Theme | alanzo |
| Albertino - Laboratory WordPress Theme | albertino |
| Alhambra | Mosque & Islamic WordPress Theme + RTL | alhambra |
| AlphaColor - Design & Printing Elementor Template Kit | alpha-color |
| Anesta - Intranet, Extranet, Community and BuddyPress WordPress Theme | anesta |
| Angela | Family Planning & Pregnancy Clinic WordPress Theme | angela |
| Anubia | Smoking and Hookah Bar WordPress Theme | anubia |
| Aora - Home & Lifestyle Elementor WooCommerce Theme | aora |
| Artesia - Freelancer WordPress Theme | artesia |
| Asclepius - Doctor & Medical Theme | asclepius |
| Avaz | snsavaz |
| Belicia - Luxury Resort & Hotel Theme | belicia |
| Besa - Elementor Marketplace WooCommerce Theme | besa |
| BeYoga | Yogastudio & Gym WordPress Theme | beyoga |
| Birdily | Travel Agency & Tour Booking WordPress Theme | birdily |
| BodyCenter - Gym, Fitness WooCommerce WordPress Theme | bodycenter |
| Bonko | Safari & Zoo WordPress Theme | bonko |
| Booklovers - Publishing House, Bookshop & BookStore WordPress Theme + RTL | booklovers |
| Callie Britt | Family Counselling Psychology WordPress Theme | callie-britt |
| Camelia | Floral Studio Florist WordPress Theme | camelia |
| Carlax | Car Parts Store & Auto Service WordPress Theme | carlax |
| Carz — Car Dealer, Shop & Repair WordPress Theme | carz |
| ChainPress | Financial Business Blog PSD Template | chainpress |
| Chakra - Yoga Retreat & Leisure Center WordPress Theme | chakra |
| Chardonnay - Wine Store & Vineyard WordPress Theme | chardonnay |
| Childy — Kids Store & Baby Clothing WordPress Theme | childy |
| Chrimson | Windows & Doors Installation Services Store WordPress Theme + AI | chrimson |
| City Hostel | Travel & Hotel Booking WordPress Theme | cityhostel |
| Corredo | Motorcycle & Bike Race Sports WordPress Theme | corredo |
| CozyStay - Hotel Booking WordPress Theme | cozystay |
| CraftXtore - Handmade, Ceramics and Pottery Shop WooCommerce Theme | bw-craftxtore |
| Credit Card Experience | Loan Company and Online Banking WordPress Theme | credit-card |
| Crework | Coworking and Creative Space WordPress Theme | crework |
| Custom Made | Jewelry Manufacturer and Store WordPress Theme | custom-made |
| Def — CCTV & Bodyguard Security WordPress Theme | def |
| Diza - Pharmacy Store Elementor WooCommerce Theme | diza |
| Drone Media | Aerial Photography & Videography Theme | drone-media |
| DSK - Furniture Store WooCommerce WordPress Theme | dsk |
| Edema | Wellness & Spa WordPress Theme | edema |
| edmin | edmin |
| Elementra - 100% Elementor WordPress Theme | elementra |
| Evon - Bag Store WooCommerce WordPress Theme | snsevon |
| Fana - Fashion Shop WordPress Theme | fana |
| Fitrush - Fitness and Health Supplements WordPress Theme | bw-fitrush |
| Flozen - WooCommerce AJAX WordPress RTL Theme | flozen-theme |
| Fortunio - Carpenter, Forestry, Wood Manufacture Theme | fortunio |
| GiftXtore - Luxury Jewelry & Gift Store Elementor WooCommerce WordPress Theme | bw-giftxtore |
| Good Wine | Vineyard & Winery Shop WordPress Theme | good-wine |
| GrandPrix - Motorcycle WordPress Theme | grandprix |
| Gravity | Interior Design & Furniture Store WordPress Theme | gravity |
| Grill and Chow - Fast Food & Pizza WordPress Theme | grillandchow |
| Gutentype | 100% Gutenberg Blog Theme + Elementor | gutentype |
| Hampton | Home Design and Renovation WordPress Theme | hampton |
| Happy Rider - Horse School & Equestrian Center WordPress Theme | happy-rider |
| Hara - Beauty and Cosmetics Shop WooCommerce Theme | hara |
| Healthy Blog - Blog WordPress Theme + Store | healthy-blog |
| Heaven11 | Property & Apartment Real Estate WordPress Theme | heaven11 |
| Hello Summer | Children Camp WordPress Theme | hello-summer |
| Hogwords | School, University Education WordPress Theme | hogwords |
| HotLock | Locksmith & Security Systems WordPress Theme + RTL | hotlock |
| Inset - Digital Agency & IT Services WordPress Theme | inset |
| Insurance Ancora - Finance WordPress Theme | insurance-ancora |
| Juno | Kids Toys & Games Store WordPress Theme | juno |
| Kargo | Logistics & Transportation PSD Template | kargo |
| Lab - Pharmacy, Laboratory & Research WordPress Theme | lab |
| Lasa - Creative Minimal WooCommerce WordPress Theme | lasa |
| Laundry City | Dry Cleaning Services WordPress Theme | laundrycity |
| Let's Play | Hockey School & Winter Sports WordPress Theme | playhockey |
| Maia - Jewelry Shop WordPress Theme | maia |
| MediaFlex - TV Channel & Streaming WordPress Theme | mediaflex |
| MediClinic - Medical Healthcare WordPress Theme | mediclinic |
| Nazareth | Church & Religion WordPress Theme | nazareth |
| Nika - Medical Elementor WooCommerce Theme | nika |
| Nitan – Fashion WooCommerce WordPress Theme | snsnitan |
| OldStory - Whisky Bar | Pub | Restaurant Site Template | oldstory-whisky-bar |
| Partiso | Political Party & Candidate Elementor Template Kit | partiso |
| PathWell | Senior Care WordPress Theme | pathwell |
| Petito - Animals and Pets Store WooCommerce Theme | bw-petito |
| Photography | photography |
| Planet Shakers | Church & Religion WordPress Theme | planet-shakers |
| Plastica - Plastic Surgery & Beauty WordPress Theme | plastica |
| Podium | Fashion Model Agency WordPress Theme | podium |
| Preston | Fruit Company & Organic Farming WordPress Theme | preston |
| ProDent | Dental Clinic & Doctor WordPress Theme + Elementor + RTL | prodent |
| ProGuards | Safety & Security Site Template | proguards |
| ProRange | Painting & Renovation Theme | prorange |
| Qwery - Multi-Purpose Business WordPress & WooCommerce Theme + ChatGPT | qwery |
| RH - Real Estate WordPress Theme | realhomes |
| Ruza - Beauty Cosmetics Shop WordPress Theme | ruza |
| Samadhi | Oriental Buddhist Temple WordPress Theme | samadhi |
| Sapa - Product Landing Page WooCommerce Theme | sapa |
| Simen - MultiPurpose WooCommerce WordPress Theme | snssimen |
| Smart Casa | Home Automation & House Technologies WordPress Theme | smart-casa |
| SNS Anton - Furniture WooCommerce WordPress Theme | snsanton |
| SoccerClub - Football Team & Soccer League WordPress Theme | soccerclub |
| Softic - SaaS Software & Application WordPress Theme | softic |
| Solio - Solar & Renewable Energy WordPress Theme | solio |
| Spare - Ultimate MultiPurpose LESS Theme | spare |
| StevenWatkins - Personal Gym Trainer WordPress Theme | stevenwatkins |
| Stratego - Corporate Business & Consulting WordPress Theme | stratego |
| Studeon | Education Center & Training Courses WordPress Theme | studeon |
| Tantra | Yoga Studio and Fitness Club WordPress Theme | tantra |
| Tax Help - Finance & Accounting Adviser Theme | tax-help |
| TinySalt - Personal Food Blog WordPress Theme | tinysalt |
| Translang - Language Courses & Translation Services Elementor Template Kit | translang |
| Travesia | Travel Agency and Tour Booking WordPress Theme | travesia |
| Vagabonds - Travel Blog Elementor Template Kit | vagabonds |
| Valen - Sport, Fashion WooCommerce WordPress Theme | valen |
| Wine House | Winery & Restaurant WordPress Theme | wine-house |
| Wise Move | Relocation and Storage Services WordPress Theme | wisemove |
| WotaHub | Coworking Space WordPress Theme | wotahub |
| Zagg - Electronics & Accessories WooCommerce WordPress Theme | bw-zagg |
| Zota - Elementor Multi-Purpose WooCommerce Theme | zota |
Vulnerability Details
Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.
Affected Software
Researcher
Affected Software
Avaz [snsavaz]
Researcher
Affected Software
Researcher
BodyCenter - Gym, Fitness WooCommerce WordPress Theme <= 2.4 - Unauthenticated Local File Inclusion
9.8
Affected Software
Researcher
Affected Software
CozyStay - Hotel Booking WordPress Theme [cozystay]
Researcher
Affected Software
CozyStay - Hotel Booking WordPress Theme [cozystay]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Flozen - WooCommerce AJAX WordPress RTL Theme [flozen-theme]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
GrandPrix - Motorcycle WordPress Theme [grandprix]
Researcher
Affected Software
Grill and Chow - Fast Food & Pizza WordPress Theme [grillandchow]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Ovatheme Events Manager [ova-events-manager]
Researcher
Affected Software
Researcher
Affected Software
ReFormer – Multichannel Contact Form for Elementor [reformer-elementor]
Researcher
Affected Software
REST API | Custom API Generator For Cross Platform And Import Export In WP [import-export-with-custom-rest-api]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Valen - Sport, Fashion WooCommerce WordPress Theme <= 2.4 - Unauthenticated Local File Inclusion
9.8
Affected Software
Researcher
Affected Software
WooCommerce Designer Pro [wc-designer-pro]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Image Resizer On The Fly [image-resizer-on-the-fly]
Researcher
Affected Software
PT Luxa Addons [pt-luxa-addons]
Researcher
Abandoned Cart Pro for WooCommerce <= 9.16.0 - Authenticated (Subscriber+) Arbitrary File Upload
8.8
Affected Software
Abandoned Cart Pro for WooCommerce [woocommerce-abandon-cart-pro]
Researcher
Affected Software
Axle Demo Importer [axle-demo-importer]
Researcher
Affected Software
CubeWP Framework [cubewp-framework]
Researcher
Affected Software
MapSVG [mapsvg]
Researcher
Affected Software
MapSVG [mapsvg]
Researcher
Affected Software
RH - Real Estate WordPress Theme [realhomes]
Researcher
Affected Software
School Management System for Wordpress [school-management]
Researcher
Affected Software
Widget Logic [widget-logic]
Researcher
Affected Software
WordPress Automatic Plugin [wp-automatic]
Researcher
Affected Software
Researcher
Affected Software
WPGYM - Wordpress Gym Management System [gym-management]
Researcher
Affected Software
Abogado - Lawyer WordPress Theme [abogado]
Albertino - Laboratory WordPress Theme [albertino]
A.Williams | Assistant & Administrative Services WordPress Theme [alisha-williams]
Researchers
Affected Software
Photography [photography]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
CLEVER - HTML5 Radio Player With History - Shoutcast and Icecast - WordPress Plugin [lbg-audio11-html5-shoutcast_history]
Researcher
Affected Software
PostaPanduri [postapanduri]
Researcher
Affected Software
School Management System for Wordpress [school-management]
Researcher
Affected Software
Smart Notification Wordpress Plugin. Web & Mobile Push, FB Messenger, FB Notifications & Newsletter. [smio-push-notification]
Researcher
Affected Software
TicketBAI Facturas para WooCommerce [wp-ticketbai]
Researcher
Affected Software
Researcher
Affected Software
WP Travel Engine – Tour Booking Plugin – Tour Operator Software [wp-travel-engine]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
File Manager Pro – Filester [filester]
Researcher
Affected Software
WP Lightbox 2 [wp-lightbox-2]
Researcher
Affected Software
WP-DownloadManager [wp-downloadmanager]
Researcher
Affected Software
Xagio SEO – AI Powered SEO [xagio-seo]
Researcher
Affected Software
Hydra Booking — Appointment Scheduling & Booking Calendar [hydra-booking]
Researcher
Affected Software
Malcure Malware Shield — Removal, Repair, Monitor [wp-malware-removal]
Researcher
Affected Software
Restrict File Access [restrict-file-access]
Researcher
Affected Software
Partial Shipment for Woocommerce [wc-partial-shipment]
Researcher
Affected Software
ACF Onyx Poll [acf-onyx-poll]
Researcher
Affected Software
Advanced Sermons [advanced-sermons]
Researcher
Affected Software
Arconix Shortcodes [arconix-shortcodes]
Researcher
Affected Software
Click to Chat – HoliThemes [click-to-chat-for-whatsapp]
Researcher
Color Palette <= 4.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via hex Parameter
6.4
Affected Software
Color Palette [color-palette]
Researcher
Affected Software
Contact Us Page – Contact People [contact-us-page-contact-people]
Researcher
Affected Software
CubeWP Framework [cubewp-framework]
Researcher
Affected Software
DIOT SCADA with MQTT [ecava-diot-scada]
Researcher
Affected Software
Contact Form Plugin [contact-form-lite]
Researcher
Affected Software
Elementor Website Builder Pro [elementor-pro]
Researcher
Affected Software
Game Review Block [game-review-block]
Researcher
Affected Software
Researcher
IndieBlocks <= 0.13.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via kind Parameter
6.4
Affected Software
IndieBlocks [indieblocks]
Researcher
Affected Software
IRM Newsroom [irm-newsroom]
Researcher
Affected Software
IRM Newsroom [irm-newsroom]
Researcher
Affected Software
IRM Newsroom [irm-newsroom]
Researcher
Affected Software
Kama Click Counter [kama-clic-counter]
Researcher
Affected Software
kk Youtube Video [kk-youtube-video]
Researcher
Affected Software
Meks Flexible Shortcodes [meks-flexible-shortcodes]
Researcher
Affected Software
Premium Addons for Elementor – Powerful Elementor Templates & Widgets [premium-addons-for-elementor]
Researcher
Affected Software
ProfileGrid – User Profiles, Groups and Communities [profilegrid-user-profiles-groups-and-communities]
Researcher
Affected Software
Responsive Blocks – Page Builder for Blocks & Patterns [responsive-block-editor-addons]
Researcher
Affected Software
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin [simply-schedule-appointments]
Researcher
Affected Software
Researcher
Affected Software
Smash Balloon Social Post Feed – Simple Social Feeds for WordPress [custom-facebook-feed]
Researcher
Affected Software
StreamWeasels Kick Integration [streamweasels-kick-integration]
Researcher
The Events Calendar <= 6.13.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
6.4
Affected Software
The Events Calendar [the-events-calendar]
Researcher
Affected Software
Ultimate Blocks – 25+ Gutenberg Blocks for Block Editor [ultimate-blocks]
Researcher
Affected Software
WP Views Counter [wpecounter]
Researcher
Affected Software
WPAdverts – Classifieds Plugin [wpadverts]
Researcher
Affected Software
YITH WooCommerce Wishlist [yith-woocommerce-wishlist]
Researcher
Affected Software
Zotpress [zotpress]
Researcher
Affected Software
FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce [wp-marketing-automations]
Researcher
Affected Software
Easy Flashcards [easy-flashcards]
Researcher
Affected Software
eForm - WordPress Form Builder [wp-fsqm-pro]
Researcher
Affected Software
Elite Video Player [elite-video-player]
Researcher
Affected Software
flexo-posts-manager [flexo-posts-manager]
Researcher
Affected Software
flexoslider [flexoslider]
Researcher
Affected Software
Link Shield [link-shield]
Researcher
Affected Software
Track, Analyze & Optimize by WP Tao [wp-tao]
Researcher
Affected Software
Ultimate Reviews [ultimate-reviews]
Researcher
Affected Software
WidgetKit Pro [widgetkit-pro]
Researcher
Affected Software
WP Wizard Cloak [wp-wizard-cloak]
Researcher
Affected Software
WP URL Shortener [wp-url-shortener]
Researcher
Affected Software
Researcher
Affected Software
XiSearch bar [xisearch-bar]
Researcher
Affected Software
Zen Sticky Social [zen-social-sticky]
Researcher
Affected Software
Researcher
Affected Software
Auto Attachments [auto-attachments]
Researcher
Affected Software
Aeroscroll Gallery – Infinite Scroll Image Gallery & Post Grid with Photo Gallery [aeroscroll-gallery]
Researcher
Affected Software
AFS Analytics [addfreestats]
Researcher
Affected Software
Digital Marketing and Agency Templates Addons for Elementor [digital-marketing-agency-templates-for-elementor]
Researcher
Affected Software
Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin [majestic-support]
Researcher
Affected Software
Membership For WooCommerce [membership-for-woocommerce]
Researcher
Affected Software
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions [dc-woocommerce-multi-vendor]
Researcher
Affected Software
Researcher
Affected Software
Private Post Share [sharable-password-protected-posts]
Researcher
Affected Software
Traffic Monitor [traffic-monitor]
Researcher
Affected Software
WordPress Single Sign-On (SSO) - Single Site Standard [miniorange-oauth-oidc-single-sign-on]
WordPress Single Sign-On (SSO) - Single Site Premium [miniorange-oauth-oidc-single-sign-on]
WordPress Single Sign-On (SSO) - Multisite Premium [miniorange-oauth-oidc-single-sign-on]
WordPress Single Sign-On (SSO) - Single Site Enterprise [miniorange-oauth-oidc-single-sign-on]
WordPress Single Sign-On (SSO) - Multisite Enterprise [miniorange-oauth-oidc-single-sign-on]
WordPress Single Sign-On (SSO) - Single Site All-Inclusive [miniorange-oauth-oidc-single-sign-on]
WordPress Single Sign-On (SSO) - Multisite All-Inclusive [miniorange-oauth-oidc-single-sign-on]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
WP Employee Attendance System [wp-employee-attendance-system]
Researcher
Affected Software
WP-DownloadManager [wp-downloadmanager]
Researcher
Affected Software
Ebook Store [ebook-store]
Researcher
Affected Software
Simple Newsletter Plugin – Noptin [newsletter-optin-box]
Researcher
Affected Software
Telegram for WP [telegram-for-wp]
Researcher
Affected Software
Researcher
Affected Software
Advanced Settings 3 [advanced-settings]
Researcher
AI Image Lab – Free AI Image Generator <= 1.0.6 - Cross-Site Request Forgery to API Key Update
4.3
Affected Software
AI Image Lab – Free AI Image Generator [ai-image-generator-lab]
Researcher
Affected Software
Arconix FAQ [arconix-faq]
Researcher
Affected Software
Bunny’s Print CSS [bunnys-print-css]
Researcher
Affected Software
CubeWP Forms [cubewp-forms]
Researcher
Affected Software
Hydra Booking — Appointment Scheduling & Booking Calendar [hydra-booking]
Researcher
Affected Software
Researcher
Affected Software
Premmerce User Roles [premmerce-user-roles]
Researcher
Affected Software
Responsive Plus – Elementor Templates & Starter Sites [responsive-add-ons]
Researcher
Affected Software
Seriously Simple Podcasting [seriously-simple-podcasting]
Researcher
Affected Software
WP Sliding Login/Dashboard Panel [wp-sliding-logindashboard-panel]
Researcher
Affected Software
WP2HTML [wp2html]
Researcher
Affected Software
Yougler Blogger Profile Page [yougler-blogger-profile-page]
Researcher
As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.
This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
Comments