Wordfence Intelligence Weekly WordPress Vulnerability Report (November 17, 2025 to November 23, 2025)
Last week, there were 173 vulnerabilities disclosed in 158 WordPress Plugins and 2 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 71 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.
Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back.
Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 31,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
New Firewall Rules Deployed Last Week
The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.
The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:
-
- WAF-RULE-876 – Data redacted while we work with the vendor on a patch.
Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.
Total Unpatched & Patched Vulnerabilities Last Week
| Patch Status | Number of Vulnerabilities |
|---|---|
| Patched | 124 |
| Unpatched | 49 |
Total Vulnerabilities by CVSS Severity Last Week
| Severity Rating | Number of Vulnerabilities |
|---|---|
| Medium Severity | 142 |
| High Severity | 30 |
| Critical Severity | 1 |
Total Vulnerabilities by CWE Type Last Week
| Vulnerability Type by CWE | Number of Vulnerabilities |
|---|---|
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 56 |
| Missing Authorization | 50 |
| Cross-Site Request Forgery (CSRF) | 11 |
| Unrestricted Upload of File with Dangerous Type | 8 |
| Exposure of Sensitive Information to an Unauthorized Actor | 7 |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 7 |
| Server-Side Request Forgery (SSRF) | 7 |
| Authorization Bypass Through User-Controlled Key | 6 |
| Improper Authorization | 4 |
| External Control of File Name or Path | 2 |
| Files or Directories Accessible to External Parties | 2 |
| Improper Control of Generation of Code ('Code Injection') | 2 |
| Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) | 2 |
| Missing Authentication for Critical Function | 2 |
| Deserialization of Untrusted Data | 1 |
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | 1 |
| Improper Input Validation | 1 |
| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 1 |
| Improper Neutralization of Formula Elements in a CSV File | 1 |
| Insufficient Verification of Data Authenticity | 1 |
| URL Redirection to Untrusted Site ('Open Redirect') | 1 |
Researchers That Contributed to WordPress Security Last Week
| Researcher Name | Number of Vulnerabilities |
|---|---|
| 14 | |
| 11 | |
| 9 | |
| 8 | |
| 6 | |
| 6 | |
| 6 | |
| 5 | |
| 5 | |
| 5 | |
| 4 | |
| 4 | |
| 4 | |
| 4 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.
WordPress Plugins with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| Accordion Slider | accordion-slider |
| ACF Flexible Layouts Manager | acf-flexible-layouts-manager |
| Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager | ap-plugin-scripteo |
| Affiliate AI Lite | affiliate-ai-lite |
| AI Engine – The Chatbot, AI Framework & MCP for WordPress | ai-engine |
| Appointment Booking Calendar | appointment-booking-calendar |
| Appointment Bookings for Zoom GoogleMeet and more – Wappointment | wappointment |
| ArtiBot Free Chat Bot for WebSites | artibot |
| ArtPlacer Widget | artplacer-widget |
| AudioTube | audiotube |
| AuthorSure | authorsure |
| Better Chat Support for Messenger | better-chat-support |
| Better Search – Relevant search results for WordPress | better-search |
| BigBuy Dropshipping Connector for WooCommerce | bigbuy-wc-dropshipping-connector |
| Booking Calendar Contact Form | booking-calendar-contact-form |
| Booking for Appointments and Events Calendar – Amelia | ameliabooking |
| BrightTALK WordPress Shortcode | brighttalk-wp-shortcode |
| Broken Link Checker by AIOSEO – Find & Fix Broken Internal, External & Video Links | broken-link-checker-seo |
| Bulma Shortcodes | bulma-shortcodes |
| Category and Product Woocommerce Tabs | category-and-product-woocommerce-tabs |
| CBX Bookmark & Favorite | cbxwpbookmark |
| ChatHelp – Click to Chat Button, WooCommerce Chat to Order & Floating Chat Form | chat-help |
| Checkout Files Upload for WooCommerce | checkout-files-upload-woocommerce |
| Classified Listing – AI-Powered Classified ads & Business Directory | classified-listing |
| Code Snippets | code-snippets |
| Coil Web Monetization | coil-web-monetization |
| Community Events | community-events |
| Compliance by Hu-manity.co | cookie-notice |
| CP Contact Form with PayPal | cp-contact-form-with-paypal |
| Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO | tokenico-cryptocurrency-token-launchpad-presale-ico-ido-airdrop |
| Cryptocurrency Payment Gateway for WooCommerce | triplea-cryptocurrency-payment-gateway-for-woocommerce |
| CSV to SortTable | csv-to-sorttable |
| Custom Admin Menu | custom-admin-menu |
| Custom Order Numbers for WooCommerce | custom-order-numbers-for-woocommerce |
| Custom Post Type | custom-post-type |
| Directorist: AI-Powered Business Directory, Listings & Classified Ads | directorist |
| Display Pages Shortcode | display-pages-shortcode |
| Download Panel (Biggiko Team) | download-panel |
| Eagle Booking | eagle-booking |
| EchBay Admin Security | echbay-admin-security |
| Element Pack – Widgets, Templates & Addons for Elementor | bdthemes-element-pack-lite |
| ELEX WordPress HelpDesk & Customer Ticketing System | elex-helpdesk-customer-support-ticket-system |
| Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress | email-subscribers |
| Enable SVG, WebP, and ICO Upload | enable-svg-webp-ico-upload |
| Essential Addons for Elementor – Popular Elementor Templates & Widgets | essential-addons-for-elementor-lite |
| everviz – Charts, Maps and Tables – Interactive and responsive | everviz |
| Extensions for Leaflet Map | extensions-leaflet-map |
| External Media | external-media |
| Flo Forms – Easy Drag & Drop Form Builder | flo-forms |
| FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution | fluent-crm |
| ForumWP – Forum & Discussion Board | forumwp |
| FunnelKit – Funnel Builder for WooCommerce Checkout | funnel-builder |
| FV Antispam | fv-antispam |
| Gallery with thumbnail slider | gallery-with-thumbnail-slider |
| Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers | rafflepress |
| GiveWP – Donation Plugin and Fundraising Platform | give |
| GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more | godam |
| Grand Restaurant Theme Elements for Elementor | grandrestaurant-elementor |
| Gravity Forms | gravityforms |
| Groundhogg — CRM, Newsletters, and Marketing Automation | groundhogg |
| GSheetConnector For Ninja Forms | gsheetconnector-ninja-forms |
| Gutenify – Visual Site Builder Blocks & Site Templates | gutenify |
| HandL UTM Grabber / Tracker | handl-utm-grabber |
| HelloLeads CRM Form Shortcode | hls-crm-form-shortcode |
| HotelRunner Booking Widget | hotelrunner |
| HT Mega Addons for Elementor – Elementor Widgets & Template Builder | ht-mega-for-elementor |
| Ibtana – WordPress Website Builder | ibtana-visual-editor |
| Icon List Block – Add Icon-Based Lists with Custom Styles | icon-list-block |
| IDonate – Blood Donation, Request And Donor Management System | idonate |
| Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier ) | image-hover-effects-ultimate |
| Import WP – Export and Import CSV and XML files to WordPress | jc-importer |
| Islamic Phrases | islamic-phrases |
| LearnPress – WordPress LMS Plugin for Create and Sell Online Courses | learnpress |
| Legal Pages – Privacy Policy, Terms & Conditions, GDPR, CCPA, and Cookie Notice Generator | legal-pages |
| LightGallery WP | lightgallerywp |
| Like-it | like-it |
| Local Syndication | local-syndication |
| Magical Shop Builder – WooCommerce Template Builder for Elementor | Shop, Cart, Checkout & Product Page Builder | magical-products-display |
| Meta Display Block | meta-display-block |
| Modula Image Gallery – Photo Grid & Video Gallery | modula-best-grid-gallery |
| morkva Checkbox Integration | checkbox |
| Multiple Roles per User | multiple-roles-per-user |
| New User Approve | new-user-approve |
| Offload, AI & Optimize with Cloudflare Images | cf-images |
| OneClick Chat to Order | oneclick-whatsapp-order |
| Padlet Shortcode | wallwisher-shortcode |
| Payment Gateway bKash for WC | woo-payment-bkash |
| Pet-Manager – Petfinder | tier-management-petfinder |
| Photonic Gallery & Lightbox for Flickr, SmugMug & Others | photonic |
| Pie Forms — Drag & Drop Form Builder | pie-forms-for-wp |
| PiWeb Live sales notification for WooCommerce | live-sales-notifications-for-woocommerce |
| Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing | woocommerce-google-adwords-conversion-tracking-tag |
| Pollcaster Shortcode Plugin | pollcaster-shortcode |
| Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers | popup-builder-block |
| Portfolio, Gallery, Product Catalog – Grid KIT Portfolio | portfolio-wp |
| Post Type Switcher | post-type-switcher |
| PPOM – Product Addons & Custom Fields for WooCommerce | woocommerce-product-addon |
| Premmerce Wholesale Pricing for WooCommerce | premmerce-woocommerce-wholesale-pricing |
| Project Honey Pot Spam Trap | project-honey-pot-spam-trap |
| Quiz Maker by AYS | quiz-maker |
| Realty Portal | realty-portal |
| Responsive Lightbox & Gallery | responsive-lightbox |
| Restrictions for BuddyPress | bp-restrict |
| RestroPress – Online Food Ordering System | restropress |
| Return Refund and Exchange For WooCommerce | woo-refund-and-exchange-lite |
| Royal Addons for Elementor – Addons and Templates Kit for Elementor | royal-elementor-addons |
| RTMKit | rometheme-for-elementor |
| S2B AI Assistant – ChatBot, Chatbot Inspector, Chatkit, Image Generator | s2b-ai-assistant |
| Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories | post-expirator |
| Shortcode for Google Street View | wp-google-street-view-shortcode |
| Shortcodes Bootstrap | shortcodes-bootstrap |
| Shortcodes Ultimate – Content Elements | shortcodes-ultimate |
| Simple User Import Export | a3-user-importer |
| Simple User Registration | wp-registration |
| SiteSEO – SEO Simplified | siteseo |
| Stock Tools | stock-tools |
| Subscriptions & Memberships for PayPal | subscriptions-memberships-for-paypal |
| SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent | supportcandy |
| Surbma | MiniCRM Shortcode | surbma-minicrm-shortcode |
| SureForms – Drag & Drop Contact Form & Form Builder, Payment Form, Survey, Quiz & Calculator | sureforms |
| Tainacan | tainacan |
| The Permalinks Cascade | the-permalinks-cascade |
| TI WooCommerce Wishlist | ti-woocommerce-wishlist |
| Time Slot – Booking and Appointment System | timeslot |
| Timetics – Appointment Booking Calendar & Scheduling System | timetics |
| Tips Shortcode | tips-shortcode |
| Top Friends | top-friends |
| TP WooCommerce Product Gallery | tp-woocommerce-product-gallery |
| UiPress lite | Effortless custom dashboards, admin themes and pages | uipress-lite |
| Ultimate Member Widgets for Elementor – Login Form, Register Form & User Directory | ultimate-member-widgets-for-elementor |
| URL Image Importer | url-image-importer |
| User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor | profile-builder |
| Vitepos – Point of Sale (POS) for WooCommerce | vitepos-lite |
| VK All in One Expansion Unit | vk-all-in-one-expansion-unit |
| Walker Core | walker-core |
| wModes – Catalog Mode, Product Pricing, Enquiry Forms & Promotions | for WooCommerce | catalog-mode-pricing-enquiry-forms-promotions |
| WP Admin Microblog | wp-admin-microblog |
| WP AUDIO GALLERY | wp-audio-gallery |
| WP Company Info | wp-company-info |
| WP Delete Post Copies | etruel-del-post-copies |
| WP Directory Kit | wpdirectorykit |
| WP Dropzone | wp-dropzone |
| WP Duplicate Page | wp-duplicate-page |
| WP Gravity Forms FreshDesk Plugin | gf-freshdesk |
| WP Login and Register using JWT | login-register-using-jwt |
| WP Migrate Lite – Migration Made Easy | wp-migrate-db |
| WP Twitter Auto Publish | twitter-auto-publish |
| WP Ultimate CSV Importer – WordPress Import & Export for CSV, XML & Excel | wp-ultimate-csv-importer |
| WP-Record | wp-record |
| WPBookit | wpbookit |
| WPeMatico RSS Feed Fetcher | wpematico |
| wpForo Forum | wpforo |
| WPS Visitor Counter | wps-visitor-counter |
| WPSite Shortcode | wpsite-shortcode |
| WSChat – WordPress Live Chat | wschat-live-chat |
| YITH WooCommerce Wishlist | yith-woocommerce-wishlist |
| Zegen Core | zegen-core |
| 简数采集器 | keydatas |
WordPress Themes with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| basel | basel |
| OnePress | onepress |
Vulnerability Details
Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Unauthenticated Arbitrary File Upload
9.8
Affected Software
ELEX WordPress HelpDesk & Customer Ticketing System [elex-helpdesk-customer-support-ticket-system]
Researcher
Category and Product Woocommerce Tabs <= 1.0 - Authenticated (Contributor+) Local File Inclusion
8.8
Affected Software
Category and Product Woocommerce Tabs [category-and-product-woocommerce-tabs]
Researcher
Affected Software
Enable SVG, WebP, and ICO Upload [enable-svg-webp-ico-upload]
Researcher
Affected Software
Realty Portal [realty-portal]
Researcher
Affected Software
URL Image Importer [url-image-importer]
Researcher
Affected Software
Vitepos – Point of Sale (POS) for WooCommerce [vitepos-lite]
Researcher
Affected Software
WP Dropzone [wp-dropzone]
Researcher
Affected Software
Zegen Core [zegen-core]
Researcher
Affected Software
CSV to SortTable [csv-to-sorttable]
Researcher
Affected Software
Gravity Forms [gravityforms]
Researcher
Affected Software
Pie Forms — Drag & Drop Form Builder [pie-forms-for-wp]
Researcher
Affected Software
WP AUDIO GALLERY [wp-audio-gallery]
Researcher
Affected Software
Code Snippets [code-snippets]
Researcher
Affected Software
Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager [ap-plugin-scripteo]
Researcher
Affected Software
basel [basel]
Researcher
Affected Software
Researcher
Affected Software
Community Events [community-events]
Researcher
Affected Software
CP Contact Form with PayPal [cp-contact-form-with-paypal]
Researcher
Affected Software
PiWeb Live sales notification for WooCommerce [live-sales-notifications-for-woocommerce]
Researcher
Affected Software
OneClick Chat to Order [oneclick-whatsapp-order]
Researcher
Affected Software
WP Directory Kit [wpdirectorykit]
Researcher
Affected Software
Checkout Files Upload for WooCommerce [checkout-files-upload-woocommerce]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Multiple Roles per User [multiple-roles-per-user]
Researcher
Affected Software
S2B AI Assistant – ChatBot, Chatbot Inspector, Chatkit, Image Generator [s2b-ai-assistant]
Researcher
Affected Software
Simple User Registration [wp-registration]
Researcher
Affected Software
WP Ultimate CSV Importer – WordPress Import & Export for CSV, XML & Excel [wp-ultimate-csv-importer]
Researchers
Affected Software
WPBookit [wpbookit]
Researcher
Affected Software
Flo Forms – Easy Drag & Drop Form Builder [flo-forms]
Researcher
Premmerce Wholesale Pricing for WooCommerce <= 1.1.10 - Authenticated (Subscriber+) SQL Injection
7.1
Affected Software
Premmerce Wholesale Pricing for WooCommerce [premmerce-woocommerce-wholesale-pricing]
Researcher
Affected Software
Researcher
Affected Software
Simple User Import Export [a3-user-importer]
Researcher
ACF Flexible Layouts Manager <= 1.1.6 - Missing Authorization to Unauthenticated Custom Field Update
6.5
Affected Software
ACF Flexible Layouts Manager [acf-flexible-layouts-manager]
Researcher
Affected Software
ArtPlacer Widget [artplacer-widget]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Accordion Slider [accordion-slider]
Researcher
Affected Software
Affiliate AI Lite [affiliate-ai-lite]
Researcher
Affected Software
AudioTube [audiotube]
Researcher
Affected Software
Better Search – Relevant search results for WordPress [better-search]
Researcher
BrightTALK WordPress Shortcode <= 2.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
BrightTALK WordPress Shortcode [brighttalk-wp-shortcode]
Researcher
Affected Software
Bulma Shortcodes [bulma-shortcodes]
Researcher
Affected Software
Compliance by Hu-manity.co [cookie-notice]
Researcher
Affected Software
CSV to SortTable [csv-to-sorttable]
Researcher
Affected Software
Display Pages Shortcode [display-pages-shortcode]
Researcher
Affected Software
Enable SVG, WebP, and ICO Upload [enable-svg-webp-ico-upload]
Researcher
Affected Software
Researcher
Affected Software
Extensions for Leaflet Map [extensions-leaflet-map]
Researcher
Affected Software
External Media [external-media]
Researcher
Affected Software
Researcher
Affected Software
FunnelKit – Funnel Builder for WooCommerce Checkout [funnel-builder]
Researcher
Affected Software
Grand Restaurant Theme Elements for Elementor [grandrestaurant-elementor]
Researcher
Affected Software
Researcher
Affected Software
HotelRunner Booking Widget [hotelrunner]
Researcher
Affected Software
HT Mega Addons for Elementor – Elementor Widgets & Template Builder [ht-mega-for-elementor]
Researcher
Affected Software
Icon List Block – Add Icon-Based Lists with Custom Styles [icon-list-block]
Researcher
Affected Software
Islamic Phrases [islamic-phrases]
Researcher
Local Syndication <= 1.5a - Authenticated (Contributor+) Server-Side Request Forgery via Shortcode
6.4
Affected Software
Local Syndication [local-syndication]
Researcher
Affected Software
Researcher
Affected Software
Meta Display Block [meta-display-block]
Researcher
Affected Software
Gallery with thumbnail slider [gallery-with-thumbnail-slider]
Ibtana – WordPress Website Builder [ibtana-visual-editor]
Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier ) [image-hover-effects-ultimate]
LightGallery WP [lightgallerywp]
OnePress [onepress]
Portfolio, Gallery, Product Catalog – Grid KIT Portfolio [portfolio-wp]
Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons]
TP WooCommerce Product Gallery [tp-woocommerce-product-gallery]
Researcher
Padlet Shortcode <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
6.4
Affected Software
Padlet Shortcode [wallwisher-shortcode]
Researcher
Affected Software
Pet-Manager – Petfinder [tier-management-petfinder]
Researcher
Affected Software
Researcher
Affected Software
Pollcaster Shortcode Plugin [pollcaster-shortcode]
Researcher
Affected Software
Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons]
Researcher
Affected Software
Shortcode for Google Street View [wp-google-street-view-shortcode]
Researcher
Affected Software
Shortcodes Bootstrap [shortcodes-bootstrap]
Researcher
Affected Software
Stock Tools [stock-tools]
Researcher
Affected Software
Surbma | MiniCRM Shortcode [surbma-minicrm-shortcode]
Researcher
Affected Software
Tips Shortcode [tips-shortcode]
Researcher
Affected Software
Researcher
Affected Software
Researcher
VK All in One Expansion Unit <= 9.112.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
VK All in One Expansion Unit [vk-all-in-one-expansion-unit]
Researcher
VK All in One Expansion Unit <= 9.112.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
VK All in One Expansion Unit [vk-all-in-one-expansion-unit]
Researcher
Affected Software
Walker Core [walker-core]
Researcher
Affected Software
Researcher
WP Company Info <= 1.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
6.4
Affected Software
WP Company Info [wp-company-info]
Researcher
Affected Software
Shortcodes Ultimate – Content Elements [shortcodes-ultimate]
Researcher
Affected Software
WPSite Shortcode [wpsite-shortcode]
Researcher
Affected Software
ArtiBot Free Chat Bot for WebSites [artibot]
Researcher
Affected Software
AuthorSure [authorsure]
Researcher
Affected Software
Custom Admin Menu [custom-admin-menu]
Researcher
Affected Software
EchBay Admin Security [echbay-admin-security]
Researcher
Affected Software
FV Antispam [fv-antispam]
Researcher
Affected Software
HandL UTM Grabber / Tracker [handl-utm-grabber]
Researcher
Affected Software
HandL UTM Grabber / Tracker [handl-utm-grabber]
Researcher
Project Honey Pot Spam Trap <= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
6.1
Affected Software
Project Honey Pot Spam Trap [project-honey-pot-spam-trap]
Researcher
Affected Software
WP Twitter Auto Publish [twitter-auto-publish]
Researcher
Affected Software
WPS Visitor Counter [wps-visitor-counter]
Researcher
Affected Software
WP Migrate Lite – Migration Made Easy [wp-migrate-db]
Researcher
Affected Software
Broken Link Checker by AIOSEO – Find & Fix Broken Internal, External & Video Links [broken-link-checker-seo]
Researcher
Affected Software
Classified Listing – AI-Powered Classified ads & Business Directory [classified-listing]
Researcher
Affected Software
Element Pack – Widgets, Templates & Addons for Elementor [bdthemes-element-pack-lite]
Researcher
Affected Software
Post Type Switcher [post-type-switcher]
Researcher
Affected Software
Responsive Lightbox & Gallery [responsive-lightbox]
Researcher
Affected Software
Return Refund and Exchange For WooCommerce [woo-refund-and-exchange-lite]
Researcher
Affected Software
Booking for Appointments and Events Calendar – Amelia [ameliabooking]
Researcher
Affected Software
Appointment Booking Calendar [appointment-booking-calendar]
Researcher
Affected Software
Better Chat Support for Messenger [better-chat-support]
Researcher
Affected Software
BigBuy Dropshipping Connector for WooCommerce [bigbuy-wc-dropshipping-connector]
Researcher
Affected Software
Booking Calendar Contact Form [booking-calendar-contact-form]
Researcher
Affected Software
Time Slot – Booking and Appointment System [timeslot]
Researcher
Affected Software
morkva Checkbox Integration [checkbox]
Researcher
Affected Software
WP-Record [wp-record]
Researcher
Affected Software
Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO [tokenico-cryptocurrency-token-launchpad-presale-ico-ido-airdrop]
Researcher
Affected Software
Cryptocurrency Payment Gateway for WooCommerce [triplea-cryptocurrency-payment-gateway-for-woocommerce]
Researcher
Affected Software
Custom Order Numbers for WooCommerce [custom-order-numbers-for-woocommerce]
Researcher
Affected Software
Researcher
Affected Software
Essential Addons for Elementor – Popular Elementor Templates & Widgets [essential-addons-for-elementor-lite]
Researcher
Affected Software
Researcher
Affected Software
HelloLeads CRM Form Shortcode [hls-crm-form-shortcode]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
New User Approve [new-user-approve]
Researcher
Affected Software
Payment Gateway bKash for WC [woo-payment-bkash]
Researcher
Affected Software
Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing [woocommerce-google-adwords-conversion-tracking-tag]
Researcher
Affected Software
Quiz Maker by AYS [quiz-maker]
Researcher
Affected Software
Restrictions for BuddyPress [bp-restrict]
Researcher
Affected Software
SiteSEO – SEO Simplified [siteseo]
Researcher
Affected Software
Subscriptions & Memberships for PayPal [subscriptions-memberships-for-paypal]
Researcher
SureForms <= 1.13.1 - Cross-Site Request Forgery Protection Bypass via Improper Nonce Distribution
5.3
Affected Software
Researcher
Affected Software
TI WooCommerce Wishlist [ti-woocommerce-wishlist]
Researcher
Affected Software
Researcher
Affected Software
Ultimate Member Widgets for Elementor – Login Form, Register Form & User Directory [ultimate-member-widgets-for-elementor]
Researcher
Affected Software
wpForo Forum [wpforo]
Researcher
Affected Software
YITH WooCommerce Wishlist [yith-woocommerce-wishlist]
Researcher
Affected Software
YITH WooCommerce Wishlist [yith-woocommerce-wishlist]
Researcher
Affected Software
Researcher
Affected Software
简数采集器 [keydatas]
Researcher
Affected Software
WP Gravity Forms FreshDesk Plugin [gf-freshdesk]
Researcher
Affected Software
WP Delete Post Copies [etruel-del-post-copies]
Researcher
Affected Software
WPeMatico RSS Feed Fetcher [wpematico]
Researcher
Affected Software
CBX Bookmark & Favorite [cbxwpbookmark]
Researcher
Affected Software
Coil Web Monetization [coil-web-monetization]
Researcher
Affected Software
Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO [tokenico-cryptocurrency-token-launchpad-presale-ico-ido-airdrop]
Researcher
Affected Software
Custom Post Type [custom-post-type]
Researcher
Affected Software
Download Panel (Biggiko Team) [download-panel]
Researcher
Affected Software
Eagle Booking [eagle-booking]
Researcher
Affected Software
Eagle Booking [eagle-booking]
Researcher
Affected Software
ELEX WordPress HelpDesk & Customer Ticketing System [elex-helpdesk-customer-support-ticket-system]
Researcher
Affected Software
ELEX WordPress HelpDesk & Customer Ticketing System [elex-helpdesk-customer-support-ticket-system]
Researcher
Affected Software
ELEX WordPress HelpDesk & Customer Ticketing System [elex-helpdesk-customer-support-ticket-system]
Researcher
Affected Software
ELEX WordPress HelpDesk & Customer Ticketing System [elex-helpdesk-customer-support-ticket-system]
Researcher
Affected Software
ELEX WordPress HelpDesk & Customer Ticketing System [elex-helpdesk-customer-support-ticket-system]
Researcher
Affected Software
ELEX WordPress HelpDesk & Customer Ticketing System [elex-helpdesk-customer-support-ticket-system]
Researcher
Affected Software
ForumWP – Forum & Discussion Board [forumwp]
Researcher
Affected Software
Researcher
Affected Software
GSheetConnector For Ninja Forms [gsheetconnector-ninja-forms]
Researcher
Affected Software
Modula Image Gallery – Photo Grid & Video Gallery [modula-best-grid-gallery]
Researcher
Affected Software
Offload, AI & Optimize with Cloudflare Images [cf-images]
Researcher
Affected Software
PPOM – Product Addons & Custom Fields for WooCommerce [woocommerce-product-addon]
Researcher
Affected Software
RestroPress – Online Food Ordering System [restropress]
Researcher
Affected Software
Return Refund and Exchange For WooCommerce [woo-refund-and-exchange-lite]
Researcher
Affected Software
Researcher
Affected Software
SiteSEO – SEO Simplified [siteseo]
Researcher
Affected Software
Researcher
Affected Software
The Permalinks Cascade [the-permalinks-cascade]
Researcher
Affected Software
Top Friends [top-friends]
Researcher
Affected Software
Researcher
Affected Software
wModes – Catalog Mode, Product Pricing, Enquiry Forms & Promotions | for WooCommerce [catalog-mode-pricing-enquiry-forms-promotions]
Researcher
Affected Software
WP Admin Microblog [wp-admin-microblog]
Researcher
Affected Software
WP Duplicate Page [wp-duplicate-page]
Researcher
Affected Software
WP Login and Register using JWT [login-register-using-jwt]
Researcher
Affected Software
WSChat – WordPress Live Chat [wschat-live-chat]
Researcher
As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.
This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
Comments