Wordfence Intelligence Weekly WordPress Vulnerability Report (October 27, 2025 to November 2, 2025)
📢 Calling all Vulnerability Researchers and Bug Bounty Hunters! 📢
🚀 Operation: Maximum Impact Challenge! Now through November 10, 2025, earn 2X bounty rewards for all in-scope submissions in software with at least 5,000 active installs and fewer than 5 million active installs. Bounties up to $31,200 per vulnerability. Submit bold. Earn big!
📁 The LFInder Challenge: Refine your LFI hunting skills with an expanded scope. Now through November 24, 2025, all LFI vulnerabilities in software with at least 25 active installs are considered in-scope for all researchers, regardless of researcher tier, AND earn a 30% bonus on all Local File Inclusion vulnerability submissions not already increased by another promotion.
Last week, there were 113 vulnerabilities disclosed in 94 WordPress Plugins and 11 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 58 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.
Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back.
Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 29,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
New Firewall Rules Deployed Last Week
The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.
The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:
- WAF-RULE-871 – Data redacted while we work with the vendor on a patch.
- Alone – Charity Multipurpose Non-profit WordPress Theme <= 7.8.3 – Missing Authorization to Unauthenticated Arbitrary File Upload via Plugin Installation (Extended Coverage)
- WAF-RULE-873 – Data redacted while we work with the vendor on a patch.
Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.
Total Unpatched & Patched Vulnerabilities Last Week
| Patch Status | Number of Vulnerabilities |
|---|---|
| Patched | 96 |
| Unpatched | 17 |
Total Vulnerabilities by CVSS Severity Last Week
| Severity Rating | Number of Vulnerabilities |
|---|---|
| Medium Severity | 75 |
| High Severity | 30 |
| Critical Severity | 8 |
Total Vulnerabilities by CWE Type Last Week
| Vulnerability Type by CWE | Number of Vulnerabilities |
|---|---|
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 30 |
| Missing Authorization | 30 |
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | 10 |
| Cross-Site Request Forgery (CSRF) | 7 |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 5 |
| Unrestricted Upload of File with Dangerous Type | 5 |
| Authorization Bypass Through User-Controlled Key | 3 |
| Deserialization of Untrusted Data | 3 |
| Exposure of Sensitive Information to an Unauthorized Actor | 3 |
| Improper Authorization | 2 |
| Improper Control of Generation of Code ('Code Injection') | 2 |
| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 2 |
| Improper Privilege Management | 2 |
| Absolute Path Traversal | 1 |
| Authentication Bypass Using an Alternate Path or Channel | 1 |
| Client-Side Enforcement of Server-Side Security | 1 |
| External Control of File Name or Path | 1 |
| Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | 1 |
| Improper Output Neutralization for Logs | 1 |
| Incorrect Authorization | 1 |
| Incorrect Privilege Assignment | 1 |
| Protection Mechanism Failure | 1 |
Researchers That Contributed to WordPress Security Last Week
| Researcher Name | Number of Vulnerabilities |
|---|---|
| 22 | |
| 13 | |
| 6 | |
| 5 | |
| 4 | |
| 4 | |
| 3 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.
WordPress Plugins with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| Accessibility Tool Kit: WP Accessibility checker plugin for WCAG, Section 508, ADA, EAA Compliance | accessibility-plus |
| Advanced Ads – Ad Manager & AdSense | advanced-ads |
| Advanced Database Cleaner – Optimize & Clean Database to Speed Up Site Performance | advanced-database-cleaner |
| Analytify Pro | wp-analytify-pro |
| Anti-Malware Security and Brute-Force Firewall | gotmls |
| AppPresser – Mobile App Framework | apppresser |
| Arconix Shortcodes | arconix-shortcodes |
| attention-bar | attention-bar |
| Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment | booking-and-rental-manager-for-woocommerce |
| Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools | woocommerce-jetpack |
| Call Now Button – The Free Click to Call Button for WordPress | call-now-button |
| Community Events | community-events |
| Consulting Elementor Widgets | consulting-elementor-widgets |
| Create Posts & Terms | create-posts-terms |
| CSS & JavaScript Toolbox | css-javascript-toolbox |
| Debug Log Viewer | debug-log-viewer |
| Depicter — Popup & Slider Builder | depicter |
| Doccure Core | doccure |
| Document Library Lite | document-library-lite |
| Easy Invoice – Invoice Generator, PDF Quotes & Payments | easy-invoice |
| Easy Testimonial Slider and Form | easy-testimonial-rotator |
| Elastic Email Sender | elastic-email-sender |
| Employee Spotlight – Team Member Showcase & Meet the Team Plugin | employee-spotlight |
| ERI File Library | eri-file-library |
| EventON (Pro) - WordPress Virtual Event Calendar Plugin | eventON |
| Flying Images: Optimize and Lazy Load Images for Faster Page Speed | nazy-load |
| Folderly | folderly |
| Frontend File Manager Plugin | nmedia-user-file-uploader |
| FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) | fusewp |
| Groundhogg — CRM, Newsletters, and Marketing Automation | groundhogg |
| HUSKY – Products Filter for WooCommerce Professional | woocommerce-products-filter |
| I Order Terms | i-order-terms |
| IDonate – Blood Donation, Request And Donor Management System | idonate |
| Import WP – CSV & XML Import Export for WordPress | jc-importer |
| Inactive Logout | inactive-logout |
| Insert PHP Code Snippet | insert-php-code-snippet |
| Jannah - Extensions | jannah-extensions |
| K Elements | k-elements |
| King Addons for Elementor – 80+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce, Mega Menu, Popup Builder | king-addons |
| List category posts | list-category-posts |
| LiteSpeed Cache | litespeed-cache |
| Mailster WordPress Newsletter Plugin | mailster |
| Master Slider Pro | masterslider |
| Media Library File Download | media-download |
| Meta for WooCommerce | facebook-for-woocommerce |
| Mstore Mobile App | woo-mstoreapp-mobile-app |
| Mstoreapp Mobile | mstoreapp-mobile-app |
| Ninja Popups | arscode-ninja-popups |
| NS Maintenance Mode for WP | ns-maintenance-mode-for-wp |
| OOPSpam Anti-Spam: Spam Protection for WordPress Forms & Comments (No CAPTCHA) | oopspam-anti-spam |
| Order Export & Order Import for WooCommerce | order-import-export-for-woocommerce |
| PDF Creator Lite | pdf-creator-lite |
| Polylang | polylang |
| Popup addon for Ninja Forms | popup-addon-for-ninja-forms |
| Popup Box – Create Countdown, Coupon, Video, Contact Form Popups | ays-popup-box |
| Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App | post-smtp |
| Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates – WPLP Legal Pages | wplegalpages |
| Qi Blocks | qi-blocks |
| Qzzr Shortcode Plugin | qzzr-shortcode |
| Range Slider Addon for Gravity Forms | range-slider-addon-for-gravity-forms |
| RESTful Content Syndication | restful-syndication |
| Ronneby Theme Core | ronneby-core |
| Schema & Structured Data for WP & AMP | schema-and-structured-data-for-wp |
| Schema Scalpel | schema-scalpel |
| Service Finder Bookings | sf-booking |
| Simple Payment | simple-payment |
| Site Checkup Debug AI Troubleshooting with Wizard and Tips for Each Issue | site-checkup |
| SiteSEO – SEO Simplified | siteseo |
| Smart Coupons For WooCommerce Coupons | wt-smart-coupons-for-woocommerce |
| Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent | tablesome |
| The Events Calendar | the-events-calendar |
| Thumbnail Slider With Lightbox | wp-responsive-slider-with-lightbox |
| Translate WordPress with Weglot – Multilingual AI Translation | weglot |
| User Toolkit | user-toolkit |
| W3 Total Cache | w3-total-cache |
| WavePlayer | waveplayer |
| Web Accessibility by accessiBe | accessibe |
| WebToffee eCommerce Marketing Automation – Email marketing, Popups, Email customizer | decorator-woocommerce-email-customizer |
| WebToffee WooCommerce Product Feeds – Google Shopping, Pinterest, TikTok Ads, & More | webtoffee-product-feed |
| WooCommerce | woocommerce |
| WooCommerce Designer Pro | wc-designer-pro |
| WordPress Contact Form 7 PDF, Google Sheet & Database | rtwwcfp-wordpress-contact-form-7-pdf |
| WordPress User Extra Fields | wp-user-extra-fields |
| WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) | delicious-recipes |
| WP Discourse | wp-discourse |
| WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters | wp-google-map-plugin |
| WPC Name Your Price for WooCommerce | wpc-name-your-price |
| WPCOM Member | wpcom-member |
| wpForo Forum | wpforo |
| WPLMS Plugin | wplms_plugin |
| XML Sitemap Generator for Google | google-sitemap-generator |
| YOP Poll | yop-poll |
| Zombify | zombify |
| Яндекс Доставка (Boxberry) | boxberry |
WordPress Themes with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| Bard | bard |
| Consulting | consulting |
| Jannah - Newspaper Magazine News BuddyPress AMP | jannah |
| KALLYAS - Creative eCommerce Multi-Purpose WordPress Theme | kallyas |
| kleo | kleo |
| Masterstudy - Education WordPress Theme | masterstudy |
| Noo JobMonster | noo-jobmonster |
| Sahifa | sahifa |
| SmartMag - Newspaper Magazine & News WordPress | smart-mag |
| Soledad | soledad |
| WpResidence | wpresidence |
Vulnerability Details
Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.
Consulting Elementor Widgets <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Facebook for WooCommerce <= 3.5.7 - Missing Authorization to Unauthenticated Notification Dismissal
NS Maintenance Mode for WP <= 1.3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
Popup addon for Ninja Forms <= 3.5.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
Call Now Button <= 1.5.4 - Authenticated (Subscriber+) Missing Authorization to Multiple Functions
Qi Blocks <= 1.4.3 - Missing Authorization to Authenticated (Contributor+) Plugin Settings Update
As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.
This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
Comments