Wordfence Intelligence Weekly WordPress Vulnerability Report (September 1, 2025 to September 7, 2025)
📢 Calling all Vulnerability Researchers and Bug Bounty Hunters! 📢
🚀 Operation: Maximum Impact Challenge! Now through November 10, 2025, earn 2X bounty rewards for all in-scope submissions in software with at least 5,000 active installs and fewer than 5 million active installs. Bounties up to $31,200 per vulnerability. Submit bold. Earn big!
💉 Participate in the SQLsplorer Challenge! Now through September 22, 2025, all SQL Injection vulnerabilities in software with at least 25 active installs are considered in-scope for all researchers, regardless of researcher tier AND earn a 20% bonus on all SQL Injection vulnerability submissions.
Last week, there were 271 vulnerabilities disclosed in 190 WordPress Plugins and 70 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 61 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.
Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back.
Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 28,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
Total Unpatched & Patched Vulnerabilities Last Week
| Patch Status | Number of Vulnerabilities |
|---|---|
| Patched | 122 |
| Unpatched | 149 |
Total Vulnerabilities by CVSS Severity Last Week
| Severity Rating | Number of Vulnerabilities |
|---|---|
| Low Severity | 2 |
| Medium Severity | 189 |
| High Severity | 77 |
| Critical Severity | 3 |
Total Vulnerabilities by CWE Type Last Week
| Vulnerability Type by CWE | Number of Vulnerabilities |
|---|---|
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 99 |
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | 57 |
| Cross-Site Request Forgery (CSRF) | 37 |
| Missing Authorization | 31 |
| Deserialization of Untrusted Data | 14 |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 8 |
| Unrestricted Upload of File with Dangerous Type | 6 |
| Improper Control of Generation of Code ('Code Injection') | 4 |
| Exposure of Sensitive Information to an Unauthorized Actor | 3 |
| Server-Side Request Forgery (SSRF) | 3 |
| Absolute Path Traversal | 2 |
| Authorization Bypass Through User-Controlled Key | 2 |
| Authentication Bypass Using an Alternate Path or Channel | 1 |
| Improper Input Validation | 1 |
| Improper Output Neutralization for Logs | 1 |
| Insertion of Sensitive Information Into Sent Data | 1 |
| Missing Authentication for Critical Function | 1 |
Researchers That Contributed to WordPress Security Last Week
| Researcher Name | Number of Vulnerabilities |
|---|---|
| 37 | |
| 30 | |
| 27 | |
| 19 | |
| 17 | |
| 13 | |
| 12 | |
| 9 | |
| 8 | |
| 7 | |
| 6 | |
| 6 | |
| 5 | |
| 5 | |
| 5 | |
| 4 | |
| 4 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.
WordPress Plugins with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| Add to Feedly | add-to-feedly |
| Admin and Site Enhancements (ASE) | admin-site-enhancements |
| Admin Menu Editor | admin-menu-editor |
| Ai Auto Tool Content Writing Assistant All in One | ai-auto-tool |
| AI Engine – The Chatbot, AI Framework & MCP for WordPress | ai-engine |
| Aitasi Coming Soon | aitasi-coming-soon |
| AP HoneyPot WordPress Plugin | ap-honeypot |
| Aparat Video Shortcode | aparat-shortcode |
| ARI Fancy Lightbox – Popup for WordPress | ari-fancy-lightbox |
| Assistant – Every Day Productivity Apps | assistant |
| atec Debug | atec-debug |
| aThemes Addons for Elementor | athemes-addons-for-elementor-lite |
| Authors List | authors-list |
| Auto Last Youtube Video | auto-last-youtube-video |
| BCM Duplicate Menu | bcm-duplicate-menu |
| Biagiotti Core | biagiotti-core |
| Bonus for Woo | bonus-for-woo |
| Booking Ultra Pro Appointments Booking Calendar Plugin | booking-ultra-pro |
| Boxed Content | boxed-content |
| Brilliant Web-to-Lead for Salesforce | salesforce-wordpress-to-lead |
| Brizy – Page Builder | brizy |
| BugSnag Error Monitoring plugin | bugsnag |
| Bulk Featured Image | bulk-featured-image |
| Bulk Watermark | bulk-watermark |
| Carousel Ultimate | carousel |
| Classified Listing – AI-Powered Classified ads & Business Directory | classified-listing |
| Cloud SAML SSO – Single Sign On Login | cloud-sso-single-sign-on |
| Comment Form WP – Customize Default Comment Form | comment-form-wp |
| Compact Admin | compact-admin |
| connectDaily Events Calendar Plugin | connect-daily-web-calendar |
| Constant Contact for WordPress | constant-contact-api |
| Content Views – Post Grid & Filter, Recent Posts, Category Posts … (Shortcode, Gutenberg Blocks, and Widgets for Elementor) | content-views-query-and-display-post-page |
| Course Booking Platform | course-booking-platform |
| Custom Team Manager | custom-team-manager |
| Custom WooCommerce Checkout Fields Editor | add-fields-to-checkout-page-woocommerce |
| Dadevarzan WordPress Common | dadevarzan-common |
| Database to Excel | database-to-excel |
| Developer Tools Blocker | swiftninjapro-inspect-element-console-blocker |
| Document Engine – Download Posts as PDF, PDF Embedder, Posts to PDF | document-engine |
| Donation Forms WP by Givecloud | donation-forms-by-givecloud |
| Easy Download Media Counter | easy-download-media-counter |
| Easy Flash Embed | easy-flash-embed |
| Easy Social Feed – Social Photos Gallery and Post Feed for WordPress | easy-facebook-likebox |
| Easy Timer | easy-timer |
| eDS Responsive Menu | eds-responsive-menu |
| Ele Conditions for Elementor | ele-conditions |
| ELEX WooCommerce Google Shopping (Google Product Feed) | elex-woocommerce-google-product-feed-plugin-basic |
| Enable Latex | enable-latex |
| Etsy Shop | etsy-shop |
| Exchange Rates | exchange-rates |
| Exit Intent Popup | exitintentpopup |
| F4 Media Taxonomies | f4-media-taxonomies |
| Floating Window Music Player | floating-window-music-player |
| Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder | fluentform |
| Free Cookie Notice & Consent Banner for Privacy Compliance (GDPR, CCPA, DSGVO and others) | cookie-notice-and-consent-banner |
| Frisbii Pay | reepay-checkout-gateway |
| FW Anker | fw-anker |
| Gallery PhotoBlocks | photoblocks-grid-gallery |
| Get Cash | get-cash |
| GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership | gourl-bitcoin-payment-gateway-paid-downloads-membership |
| Great Restaurant Menu WP | best-restaurant-menu-by-pricelisto |
| Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor | gutentor |
| Hide Real Download Path | hide-real-download-path |
| Html Social share buttons | html-social-share-buttons |
| Ibtana – Ecommerce Product Addons | ibtana-ecommerce-product-addons |
| If-So Dynamic Content – Elementor & All Page Builders Personalization | if-so |
| immonex Kickstart | immonex-kickstart |
| InPost Gallery | inpost-gallery |
| Instant Locations | instant-locations |
| Invelity MyGLS connect | invelity-mygls-connect |
| IssueM | issuem |
| Job Board Manager | job-board-manager |
| Klarna Order Management for WooCommerce | klarna-order-management-for-woocommerce |
| LA-Studio Element Kit for Elementor | lastudio-element-kit |
| Latest Post Shortcode | latest-post-shortcode |
| License Manager for WooCommerce | license-manager-for-woocommerce |
| LTL Freight Quotes – Day & Ross Edition | ltl-freight-quotes-day-ross-edition |
| LTL Freight Quotes – Daylight Edition | ltl-freight-quotes-daylight-edition |
| LTL Freight Quotes – TQL Edition | ltl-freight-quotes-tql-edition |
| Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails | mail-mint |
| MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. | mailoptin |
| Make Connector | integromat-connector |
| Malcure Malware Shield — Removal, Repair, Monitor | wp-malware-removal |
| Markup Markdown | markup-markdown |
| Master Paper Collapse Toggle | master-paper-collapse-toggle |
| MasterStudy LMS WordPress Plugin – for Online Courses and Education | masterstudy-lms-learning-management-system |
| Media Author | media-author |
| MediaPress | mediapress |
| Mega Forms – Drag & Drop Form Builder with Multi-Step & Conditional Logic | mega-forms |
| Miraculous Core | miraculouscore |
| Mobile Contact Line | mobile-contact-line |
| MSTW League Manager | mstw-league-manager |
| Multi Step Form | multi-step-form |
| New Simple Gallery | new-simple-gallery |
| Ninja Charts – Interactive Charts and Graphs | ninja-charts |
| Notification for Telegram | notification-for-telegram |
| Optio Dentistry | optio-dentistry |
| Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More | themeisle-companion |
| Order Delivery Date for WooCommerce | order-delivery-date-for-woocommerce |
| Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction | paid-member-subscriptions |
| Parallax Scrolling Enllax.js | parallax-scrolling-enllax-js |
| Payoneer Checkout | payoneer-checkout |
| PDF for WPForms + Drag and Drop Template Builder | pdf-for-wpforms |
| PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) | peachpay-for-woocommerce |
| Permalink Manager Lite | permalink-manager |
| Pie Calendar – Events Calendar Made Simple | pie-calendar |
| PopAd | popad |
| Popping Sidebars and Widgets Light | popping-sidebars-and-widgets-light |
| Post Grid Gutenberg Blocks – PostX | ultimate-post |
| Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App | post-smtp |
| Posts Table with Search & Sort | posts-data-table |
| PrettyPhoto – Simple Lightbox Plugin | prettyphoto |
| Product Carousel Slider for Elementor | ecommerce-product-carousel-slider-for-elementor |
| ProfileGrid – User Profiles, Groups and Communities | profilegrid-user-profiles-groups-and-communities |
| Property Hive | propertyhive |
| Purge Varnish Cache | purge-varnish |
| Pushe Web Push Notification | pushe-webpush |
| PuzzleMe – Interactive Puzzles for WordPress – Easily publish crosswords, quizzes, word searches and more | puzzleme |
| Quick Event Calendar | quick-event-calendar |
| Quick Paypal Payments | quick-paypal-payments |
| Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker | quiz-master-next |
| Ray Enterprise Translation | lingotek-translation |
| Recent Posts Widget Extended | recent-posts-widget-extended |
| Responder | responder |
| RumbleTalk Live Group Chat – HTML5 | rumbletalk-chat-a-chat-with-themes |
| Search by Google | search-google |
| Search Cloud One | search-cloud-one |
| SEO Auto Linker | wpa-seo-auto-linker |
| short.io | wp-shortcm |
| Show Eventbrite Events – Event Feed for Eventbrite | event-feed-for-eventbrite |
| Showpass WordPress Extension | showpass |
| SimaCookie | simasicher-dsgvo-cookie |
| Simple Link List Widget | simple-link-list-widget |
| Simple Matomo Tracking Code | simple-matomo-tracking-code |
| Simple Price Calculator | simple-price-calculator-basic |
| Simple Text Slider | simple-text-slider |
| Site Info | site-info-dashboard-widget |
| SKT Addons for Elementor | skt-addons-for-elementor |
| Smart Table Builder | smart-table-builder |
| Smooth Accordion | smooth-accordion |
| Social Sharing Plugin – Kiwi | kiwi-social-share |
| Spirit Framework | spirit-framework |
| Sprout Invoices – Client Invoicing & Estimates | sprout-invoices |
| SS Font Awesome Icon | ss-font-awesome-icon |
| StagTools | stagtools |
| StoryMap Plugin | wp-storymap |
| StreamWeasels Kick Integration | streamweasels-kick-integration |
| Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions | wp-full-stripe-free |
| Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System | support-genix-lite |
| SureForms – Drag & Drop Contact Form & Form Builder, Payment Form, Survey, Quiz & Calculator | sureforms |
| Surfer – WordPress Plugin | surferseo |
| Table of content | content-table |
| Themify Popup | themify-popup |
| Tickera – Sell Tickets & Manage Events | tickera-event-ticketing-system |
| Toast Mobile Menu – PageSpeed Insights Friendly | toast-responsive-menu |
| Today's Date Inserter | todays-date-inserter |
| Tooltipy (tooltips for WP) | bluet-keywords-tooltip-generator |
| Translate This gTranslate Shortcode | translate-this-google-translate-web-element-shortcode |
| TrustMate.io – WooCommerce integration | trustmate-io-integration-for-woocommerce |
| uDesign | Multipurpose WordPress Theme | u-design-core |
| Ultimate AJAX Login | ultimate-ajax-login |
| Ultimate Client Dash | ulimate-client-dash |
| User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder | user-registration |
| UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP | userswp |
| Vayu Blocks – Website Builder for the Gutenberg Block Editor | vayu-blocks |
| vipdrv | vipdrv-vip-test-drive |
| Widgetize Pages Light | widgetize-pages-light |
| WN Flipbox Pro | wn-flipbox-pro |
| Woocommerce Gifts Product | woo-gift-product |
| Woocommerce Notify Updated Product | woocommerce-notify-updated-product |
| WooCommerce Single Page Checkout | woo-single-page-checkout |
| WordPress Buffer – HYPESocial. Social Media Auto Post, Social Media Auto Publish and Schedule | buffer-my-post |
| WordPress Helpdesk Integration | wp-helpdesk-integration |
| WP Abstracts | wp-abstracts-manuscripts-manager |
| WP Bannerize Pro | wp-bannerize-pro |
| WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) | delicious-recipes |
| WP Email Template | wp-email-template |
| WP Flow Plus | wp-imageflow2 |
| WP Github Gist | wp-github-gist |
| WP likes | wp-likes |
| WP Mail | wp-mail |
| WP Notification Bell | wp-notification-bell |
| WP Publication Archive | wp-publication-archive |
| WP-GraphViz | wp-graphviz |
| WPB Addons for Elementor – News Ticker, Timeline, Team & More Widgets | wpb-elementor-addons |
| WPB Image Widget | wpb-image-widget |
| wpForo Forum | wpforo |
| Zoomify embed for WP | zoom-image-shortcode |
| 金数据 | jinshuju |
| 코드엠샵 소셜톡 | mshop-naver-talktalk |
WordPress Themes with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| AdForest | adforest |
| Algenix - IT Solutions & Digital Agency WordPress Theme | algenix |
| Alright - Full Site Editing Business WordPress Theme | alright |
| Assembly - Conference Event & Concert WordPress Theme | assembly |
| Athos - Orthodox Christian Church WordPress Theme | athos |
| Beautique — Luxury Salon & Barbershop WordPress Theme | beautique |
| Catwalk - Fashion WordPress Theme | catwalk |
| ChildHope | Child Adoption Services & Nonprofit Theme | childhope |
| Clanora - Cleaning Services WordPress Theme | clanora |
| ConsultStreet | consultstreet |
| Convex - Architecture & Interior Design WordPress Theme | convex |
| Critique - Newspaper & Review Magazine WordPress Theme | critique |
| EasyEat - Fast Food Theme | easyeat |
| echo | echo |
| EcoGrow - Green Farming & Agriculture WordPress Theme | ecogrow |
| Emberlyn | Personal Stylist & Fashion Clothing WordPress Theme | emberlyn |
| Etta - Marketing WordPress Theme | etta |
| Exit Game | Real-Life Secret Escape Room WordPress Theme | exit-game |
| Faith & Hope | Church & Religion Non-Profit WordPress Theme | faith-hope |
| Farm Agrico | Agriculture & Organic Farm Food WordPress Theme | farmagrico |
| Femme - Fashion Blog & Magazine WordPress Theme + RTL | femme |
| FitLine — Personal Coach WordPress Theme | fitline |
| Flatsome | flatsome |
| Gardis | Blinds and Curtains WordPress Theme | gardis |
| GlamChic | Beauty Blog WordPress Theme + Store | glamchic |
| Good Mood - Wine Shop WordPress Theme | good-mood |
| Gracioza | Weight Loss & Healthy Blog WordPress Theme | gracioza |
| GreenOrganic - Organic & Bakery WordPress Theme | greenorganic |
| Greeny - Electric Car Dealership WordPress Theme | greeny |
| Hanani | Jewish Community & Synagogue WordPress Theme + RTL | hanani |
| Harper - Digital Marketing Agency WordPress Theme | harper |
| Hygia - Cleaning Services WordPress Theme | hygia |
| ITok - ICO and Cryptocurrency WordPress Theme | itok |
| Jack Well | Elections Campaign & Political WordPress Theme | jack-well |
| KALLYAS - Creative eCommerce Multi-Purpose WordPress Theme | kallyas |
| Kings & Queens | Historical War Medieval Reenactment WordPress Theme | kings-queens |
| Knowledge Base | kbase |
| Lagom | lagom |
| Legacy - Antique, Vintage & Collectibles WordPress Theme | legacy |
| Lettuce | Organic Food & Eco Online Store Products WordPress Theme | lettuce |
| Ludos Paradise | Video Gaming Blog & Clan Esports WordPress Theme | ludos-paradise |
| Lymcoin | ICO Cryptocurrency WordPress Theme | lymcoin |
| Mamita | Pregnancy & Maternity Cinique Blog WordPress Theme | mamita |
| Manufactory - Industrial WordPress Theme | manufactory |
| Militarology - Military Service & Army Veterans WordPress Theme | militarology |
| Miraculous - Multi Vendor Online Music Store Elementor WordPress Theme | miraculous |
| Monki - Fashion WooCommerce WordPress Theme | monki |
| Monyxi | ICO Cryptocurrency Trading Business Coach WordPress Theme | monyxi |
| Palladio | Interior Design & Architecture WordPress Theme | palladio |
| Paragon - Consulting & Corporate Business WordPress Theme | paragon |
| Plan My Day | Wedding / Event Planning Agency WordPress Theme | planmyday |
| Rally - Car Service & Motorcycle WordPress Theme | rally |
| REHub - Price Comparison, Multi Vendor Marketplace Wordpress Theme | rehub-theme |
| Rentic - Car Rental & Dealership WordPress Theme | rentic |
| rockon | rockon |
| SaasLauncher | saaslauncher |
| Scape - Multipurpose WordPress theme | scape |
| ShieldGroup | Insurance & Finance WordPress Theme | shieldgroup |
| Shk Corporate | shk-corporate |
| Single Property WordPress Theme - Moore | single-property |
| Smash - Tennis WordPress Theme | smash |
| SoftMe | softme |
| Strux - Architecture & Design WordPress Theme | strux |
| TheGem | thegem |
| TheGem - Creative Multi-Purpose & WooCommerce WordPress Theme | thegem-elementor |
| Towny - Handyman, Cleaning & Caregiving Services WordPress Theme | towny |
| Travel Booking WordPress Theme | traveler |
| Vocal - Singing & Voice Artist WordPress Theme | vocal |
| Wastia - Waste Pickup And Disposal Services WordPress Theme | wastia |
| Zuut | zuut |
Vulnerability Details
Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.
Affected Software
Researcher
Affected Software
Researcher
Affected Software
immonex Kickstart [immonex-kickstart]
Researcher
Affected Software
InPost Gallery [inpost-gallery]
Researcher
Affected Software
Researcher
Affected Software
MediaPress [mediapress]
Researcher
Affected Software
Cloud SAML SSO – Single Sign On Login [cloud-sso-single-sign-on]
Researcher
Affected Software
WP Abstracts [wp-abstracts-manuscripts-manager]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Catwalk - Fashion WordPress Theme [catwalk]
Researcher
Affected Software
Researcher
Affected Software
Sprout Invoices – Client Invoicing & Estimates [sprout-invoices]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
EasyEat - Fast Food Theme [easyeat]
Researcher
Affected Software
echo [echo]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
FitLine — Personal Coach WordPress Theme [fitline]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Good Mood - Wine Shop WordPress Theme [good-mood]
Researcher
Affected Software
Researcher
Affected Software
GreenOrganic - Organic & Bakery WordPress Theme [greenorganic]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Lagom [lagom]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Ludos Paradise | Video Gaming Blog & Clan Esports WordPress Theme [ludos-paradise]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Manufactory - Industrial WordPress Theme [manufactory]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker [quiz-master-next]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
ShieldGroup | Insurance & Finance WordPress Theme [shieldgroup]
Researcher
Affected Software
Smash - Tennis WordPress Theme [smash]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
WordPress Helpdesk Integration [wp-helpdesk-integration]
Researcher
Affected Software
Zuut [zuut]
Researcher
Affected Software
Constant Contact for WordPress [constant-contact-api]
Researcher
Affected Software
Knowledge Base [kbase]
Researcher
Affected Software
Researcher
Affected Software
Single Property WordPress Theme - Moore [single-property]
Researcher
Affected Software
Spirit Framework [spirit-framework]
Researcher
Affected Software
Spirit Framework [spirit-framework]
Researcher
Affected Software
Researcher
Affected Software
atec Debug [atec-debug]
Researcher
Affected Software
atec Debug [atec-debug]
Researcher
Affected Software
Bulk Featured Image [bulk-featured-image]
Researcher
Affected Software
Easy Timer [easy-timer]
Researcher
Affected Software
Exit Intent Popup [exitintentpopup]
Researcher
Affected Software
Make Connector [integromat-connector]
Researcher
Affected Software
Multi Step Form [multi-step-form]
Researcher
Affected Software
Toast Mobile Menu – PageSpeed Insights Friendly [toast-responsive-menu]
Researcher
Affected Software
Aitasi Coming Soon [aitasi-coming-soon]
Researcher
Affected Software
eDS Responsive Menu [eds-responsive-menu]
Researcher
Affected Software
LTL Freight Quotes – TQL Edition [ltl-freight-quotes-tql-edition]
Researcher
Affected Software
LTL Freight Quotes – Day & Ross Edition [ltl-freight-quotes-day-ross-edition]
Researcher
LTL Freight Quotes – Daylight Edition <= 2.2.7 - Authenticated (Administrator+) PHP Object Injection
6.6
Affected Software
LTL Freight Quotes – Daylight Edition [ltl-freight-quotes-daylight-edition]
Researcher
Ai Engine <= 2.9.5 - Missing Authorization to Unauthenticated Uploaded Files Disclosure And Deletion
6.5
Affected Software
Researcher
Affected Software
Cloud SAML SSO – Single Sign On Login [cloud-sso-single-sign-on]
Researcher
Affected Software
Researcher
Affected Software
New Simple Gallery [new-simple-gallery]
Researcher
Affected Software
Ray Enterprise Translation [lingotek-translation]
Researcher
Affected Software
Researcher
Affected Software
Admin Menu Editor [admin-menu-editor]
Researcher
Affected Software
Ai Auto Tool Content Writing Assistant All in One [ai-auto-tool]
Researcher
Affected Software
Aparat Video Shortcode [aparat-shortcode]
Researcher
Affected Software
ARI Fancy Lightbox – Popup for WordPress [ari-fancy-lightbox]
Researcher
Affected Software
aThemes Addons for Elementor [athemes-addons-for-elementor-lite]
Researcher
Affected Software
Great Restaurant Menu WP [best-restaurant-menu-by-pricelisto]
Researcher
Biagiotti Core <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
6.4
Affected Software
Biagiotti Core [biagiotti-core]
Researcher
Affected Software
Booking Ultra Pro Appointments Booking Calendar Plugin [booking-ultra-pro]
Researcher
Affected Software
Boxed Content [boxed-content]
Researcher
Affected Software
Content Views – Post Grid & Filter, Recent Posts, Category Posts … (Shortcode, Gutenberg Blocks, and Widgets for Elementor) [content-views-query-and-display-post-page]
Researcher
Affected Software
Free Cookie Notice & Consent Banner for Privacy Compliance (GDPR, CCPA, DSGVO and others) [cookie-notice-and-consent-banner]
Researcher
Affected Software
Course Booking Platform [course-booking-platform]
Researcher
Affected Software
Custom Team Manager [custom-team-manager]
Researcher
Affected Software
Dadevarzan WordPress Common [dadevarzan-common]
Researcher
Affected Software
Document Engine – Download Posts as PDF, PDF Embedder, Posts to PDF [document-engine]
Researcher
Donation Forms WP by Givecloud <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
Donation Forms WP by Givecloud [donation-forms-by-givecloud]
Researcher
Affected Software
Easy Download Media Counter [easy-download-media-counter]
Researcher
Affected Software
Easy Flash Embed [easy-flash-embed]
Researcher
Affected Software
Easy Social Feed – Social Photos Gallery and Post Feed for WordPress [easy-facebook-likebox]
Researcher
Affected Software
Show Eventbrite Events – Event Feed for Eventbrite [event-feed-for-eventbrite]
Researcher
Affected Software
Exchange Rates [exchange-rates]
Researcher
Affected Software
Flatsome [flatsome]
Researcher
Affected Software
FW Anker [fw-anker]
Researcher
Affected Software
Gallery PhotoBlocks [photoblocks-grid-gallery]
Researcher
Affected Software
Get Cash [get-cash]
Researcher
Affected Software
Html Social share buttons [html-social-share-buttons]
Researcher
Affected Software
Ibtana – Ecommerce Product Addons [ibtana-ecommerce-product-addons]
Researcher
Affected Software
Researcher
Affected Software
IssueM [issuem]
Researcher
Affected Software
Social Sharing Plugin – Kiwi [kiwi-social-share]
Researcher
Affected Software
LA-Studio Element Kit for Elementor [lastudio-element-kit]
Researcher
Affected Software
Latest Post Shortcode [latest-post-shortcode]
Researcher
Affected Software
Markup Markdown [markup-markdown]
Researcher
Affected Software
Markup Markdown [markup-markdown]
Researcher
Affected Software
Master Paper Collapse Toggle [master-paper-collapse-toggle]
Researcher
Affected Software
Optio Dentistry [optio-dentistry]
Researcher
Affected Software
Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More [themeisle-companion]
Researcher
Parallax Scrolling Enllax.js <= 0.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
Parallax Scrolling Enllax.js [parallax-scrolling-enllax-js]
Researcher
Affected Software
PDF for WPForms + Drag and Drop Template Builder [pdf-for-wpforms]
Researcher
Affected Software
Pie Calendar – Events Calendar Made Simple [pie-calendar]
Researcher
Affected Software
Property Hive [propertyhive]
Researcher
Affected Software
Researcher
Affected Software
Recent Posts Widget Extended [recent-posts-widget-extended]
Researcher
Affected Software
RumbleTalk Live Group Chat – HTML5 [rumbletalk-chat-a-chat-with-themes]
Researcher
Affected Software
short.io [wp-shortcm]
Researcher
Showpass WordPress Extension <= 4.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
Showpass WordPress Extension [showpass]
Researcher
Affected Software
SimaCookie [simasicher-dsgvo-cookie]
Researcher
Affected Software
Simple Text Slider [simple-text-slider]
Researcher
Affected Software
SKT Addons for Elementor [skt-addons-for-elementor]
Researcher
Affected Software
Smart Table Builder [smart-table-builder]
Researcher
Affected Software
Smooth Accordion [smooth-accordion]
Researcher
Affected Software
SS Font Awesome Icon [ss-font-awesome-icon]
Researcher
Affected Software
StagTools [stagtools]
Researcher
Affected Software
StoryMap Plugin [wp-storymap]
Researcher
Affected Software
StreamWeasels Kick Integration [streamweasels-kick-integration]
Researcher
Affected Software
TheGem - Creative Multi-Purpose & WooCommerce WordPress Theme [thegem-elementor]
Researcher
Affected Software
TheGem [thegem]
Researcher
Affected Software
Themify Popup [themify-popup]
Researcher
Affected Software
Today's Date Inserter [todays-date-inserter]
Researcher
Affected Software
Tooltipy (tooltips for WP) [bluet-keywords-tooltip-generator]
Researcher
Affected Software
Translate This gTranslate Shortcode [translate-this-google-translate-web-element-shortcode]
Researcher
Affected Software
Researchers
Affected Software
connectDaily Events Calendar Plugin [connect-daily-web-calendar]
Researcher
Affected Software
WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) [delicious-recipes]
Researcher
Affected Software
WP Flow Plus [wp-imageflow2]
Researcher
Affected Software
WP Github Gist [wp-github-gist]
Researcher
Affected Software
WP Mail [wp-mail]
Researcher
Affected Software
WP Notification Bell [wp-notification-bell]
Researcher
Affected Software
WP Publication Archive [wp-publication-archive]
Researcher
Affected Software
WP-GraphViz [wp-graphviz]
Researcher
Affected Software
WPB Addons for Elementor – News Ticker, Timeline, Team & More Widgets [wpb-elementor-addons]
Researcher
Affected Software
WPB Image Widget [wpb-image-widget]
Researcher
Affected Software
Zoomify embed for WP [zoom-image-shortcode]
Researcher
Affected Software
金数据 [jinshuju]
Researcher
Affected Software
코드엠샵 소셜톡 [mshop-naver-talktalk]
Researcher
Affected Software
Etsy Shop [etsy-shop]
Researcher
Floating Window Music Player <= 3.4.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
6.1
Affected Software
Floating Window Music Player [floating-window-music-player]
Researcher
Affected Software
ProfileGrid – User Profiles, Groups and Communities [profilegrid-user-profiles-groups-and-communities]
Researcher
Affected Software
rockon [rockon]
Researcher
Affected Software
Travel Booking WordPress Theme [traveler]
Researcher
Affected Software
uDesign | Multipurpose WordPress Theme [u-design-core]
Researcher
Affected Software
Woocommerce Notify Updated Product [woocommerce-notify-updated-product]
Researcher
Affected Software
Assistant – Every Day Productivity Apps [assistant]
Researcher
Affected Software
WP likes [wp-likes]
Researcher
Affected Software
WP Bannerize Pro [wp-bannerize-pro]
Researcher
Admin and Site Enhancements <= 7.9.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG
5.4
Affected Software
Admin and Site Enhancements (ASE) [admin-site-enhancements]
Researcher
Affected Software
Job Board Manager [job-board-manager]
Researcher
Affected Software
Bonus for Woo [bonus-for-woo]
Researcher
Affected Software
Researcher
Affected Software
Miraculous Core [miraculouscore]
Researcher
Affected Software
Ninja Charts – Interactive Charts and Graphs [ninja-charts]
Researcher
Affected Software
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction [paid-member-subscriptions]
Researcher
Affected Software
Payoneer Checkout [payoneer-checkout]
Researcher
Affected Software
PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) [peachpay-for-woocommerce]
Researcher
Affected Software
Permalink Manager Lite [permalink-manager]
Researcher
Affected Software
PopAd [popad]
Researcher
Affected Software
Posts Table with Search & Sort [posts-data-table]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Surfer – WordPress Plugin [surferseo]
Researcher
Affected Software
Travel Booking WordPress Theme [traveler]
Researcher
Affected Software
atec Debug [atec-debug]
Researcher
Affected Software
ELEX WooCommerce Google Shopping (Google Product Feed) [elex-woocommerce-google-product-feed-plugin-basic]
Researcher
Affected Software
License Manager for WooCommerce [license-manager-for-woocommerce]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Carousel Ultimate [carousel]
Researcher
Affected Software
Comment Form WP – Customize Default Comment Form [comment-form-wp]
Researcher
Affected Software
Ele Conditions for Elementor [ele-conditions]
Researcher
Affected Software
GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership [gourl-bitcoin-payment-gateway-paid-downloads-membership]
Researcher
Affected Software
Instant Locations [instant-locations]
Researcher
Affected Software
Researcher
Pushe Web Push Notification <= 0.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
Affected Software
Pushe Web Push Notification [pushe-webpush]
Researcher
Affected Software
Search by Google [search-google]
Researcher
Affected Software
Search Cloud One [search-cloud-one]
Researcher
Affected Software
SEO Auto Linker [wpa-seo-auto-linker]
Researcher
Affected Software
Simple Link List Widget [simple-link-list-widget]
Researcher
Simple Matomo Tracking Code <= 1.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
Affected Software
Simple Matomo Tracking Code [simple-matomo-tracking-code]
Researcher
Affected Software
Researcher
Affected Software
Ultimate Client Dash [ulimate-client-dash]
Researcher
Affected Software
vipdrv [vipdrv-vip-test-drive]
Researcher
Affected Software
Widgetize Pages Light [widgetize-pages-light]
Researcher
Affected Software
Add to Feedly [add-to-feedly]
Researcher
Affected Software
AP HoneyPot WordPress Plugin [ap-honeypot]
Researcher
Affected Software
Authors List [authors-list]
Researcher
Affected Software
Auto Last Youtube Video [auto-last-youtube-video]
Researcher
Affected Software
BCM Duplicate Menu [bcm-duplicate-menu]
Researcher
Affected Software
Brizy – Page Builder [brizy]
Researcher
Affected Software
Bulk Watermark [bulk-watermark]
Researcher
Affected Software
Classified Listing – AI-Powered Classified ads & Business Directory [classified-listing]
Researcher
Affected Software
Compact Admin [compact-admin]
Researcher
Affected Software
ConsultStreet [consultstreet]
Researcher
Affected Software
Researcher
Affected Software
Custom WooCommerce Checkout Fields Editor [add-fields-to-checkout-page-woocommerce]
Researcher
Affected Software
Database to Excel [database-to-excel]
Researcher
Affected Software
Developer Tools Blocker [swiftninjapro-inspect-element-console-blocker]
Researcher
Affected Software
Enable Latex [enable-latex]
Researcher
Affected Software
BugSnag Error Monitoring plugin [bugsnag]
Researcher
Affected Software
F4 Media Taxonomies [f4-media-taxonomies]
Researcher
Affected Software
Frisbii Pay [reepay-checkout-gateway]
Researcher
Affected Software
Researcher
Affected Software
Hide Real Download Path [hide-real-download-path]
Researcher
Affected Software
Invelity MyGLS connect [invelity-mygls-connect]
Researcher
Affected Software
Malcure Malware Shield — Removal, Repair, Monitor [wp-malware-removal]
Researcher
Affected Software
MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system]
Researcher
Affected Software
Media Author [media-author]
Researcher
Affected Software
Mobile Contact Line [mobile-contact-line]
Researcher
Affected Software
MSTW League Manager [mstw-league-manager]
Researcher
Affected Software
Notification for Telegram [notification-for-telegram]
Researcher
Affected Software
Order Delivery Date for WooCommerce [order-delivery-date-for-woocommerce]
Researcher
Affected Software
Parallax Scrolling Enllax.js [parallax-scrolling-enllax-js]
Researcher
Affected Software
Popping Sidebars and Widgets Light [popping-sidebars-and-widgets-light]
Researcher
Affected Software
Researchers
Affected Software
Post Grid Gutenberg Blocks – PostX [ultimate-post]
Researcher
Affected Software
Product Carousel Slider for Elementor [ecommerce-product-carousel-slider-for-elementor]
Researcher
Affected Software
Purge Varnish Cache [purge-varnish]
Researcher
Affected Software
Quick Event Calendar [quick-event-calendar]
Researcher
Affected Software
Quick Paypal Payments [quick-paypal-payments]
Researcher
Affected Software
Responder [responder]
Researcher
Affected Software
SaasLauncher [saaslauncher]
Researcher
Affected Software
Shk Corporate [shk-corporate]
Researcher
Affected Software
SimaCookie [simasicher-dsgvo-cookie]
Researcher
Affected Software
Simple Price Calculator [simple-price-calculator-basic]
Researcher
Affected Software
SoftMe [softme]
Researcher
Affected Software
Table of content [content-table]
Researcher
Affected Software
Tickera – Sell Tickets & Manage Events [tickera-event-ticketing-system]
Researcher
Affected Software
Brilliant Web-to-Lead for Salesforce [salesforce-wordpress-to-lead]
Researcher
Affected Software
TrustMate.io – WooCommerce integration [trustmate-io-integration-for-woocommerce]
Researcher
Affected Software
uDesign | Multipurpose WordPress Theme [u-design-core]
Researcher
Affected Software
Ultimate AJAX Login [ultimate-ajax-login]
Researcher
Affected Software
WN Flipbox Pro [wn-flipbox-pro]
Researcher
Affected Software
Woocommerce Gifts Product [woo-gift-product]
Researcher
Affected Software
WooCommerce Single Page Checkout [woo-single-page-checkout]
Researcher
Affected Software
Researcher
Affected Software
WP Email Template [wp-email-template]
Researcher
Affected Software
wpForo Forum [wpforo]
Researcher
Affected Software
Klarna Order Management for WooCommerce [klarna-order-management-for-woocommerce]
Researcher
Affected Software
Site Info [site-info-dashboard-widget]
Researcher
As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.
This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
Comments