Wordfence Intelligence Weekly WordPress Vulnerability Report (December 1, 2025 to December 7, 2025)
Last week, there were 192 vulnerabilities disclosed in 174 WordPress Plugins and 2 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 60 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.
Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back.
Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 31,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
New Firewall Rules Deployed Last Week
The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.
The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:
-
- WAF-RULE-880 – Data redacted while we work with the vendor on a patch.
- Motors <= 5.6.82 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation
- Soledad < = 8.6.9 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.
Total Unpatched & Patched Vulnerabilities Last Week
| Patch Status | Number of Vulnerabilities |
|---|---|
| Patched | 123 |
| Unpatched | 69 |
Total Vulnerabilities by CVSS Severity Last Week
| Severity Rating | Number of Vulnerabilities |
|---|---|
| Medium Severity | 160 |
| High Severity | 22 |
| Critical Severity | 10 |
Total Vulnerabilities by CWE Type Last Week
| Vulnerability Type by CWE | Number of Vulnerabilities |
|---|---|
| Missing Authorization | 56 |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 53 |
| Cross-Site Request Forgery (CSRF) | 30 |
| Exposure of Sensitive Information to an Unauthorized Actor | 14 |
| Unrestricted Upload of File with Dangerous Type | 11 |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 8 |
| Authorization Bypass Through User-Controlled Key | 6 |
| Improper Authorization | 2 |
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | 2 |
| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 2 |
| Improper Privilege Management | 2 |
| External Control of File Name or Path | 1 |
| Improper Authentication | 1 |
| Improper Control of Generation of Code ('Code Injection') | 1 |
| Incorrect Implementation of Authentication Algorithm | 1 |
| Incorrect Privilege Assignment | 1 |
| Server-Side Request Forgery (SSRF) | 1 |
Researchers That Contributed to WordPress Security Last Week
| Researcher Name | Number of Vulnerabilities |
|---|---|
| 18 | |
| 16 | |
| 14 | |
| 9 | |
| 9 | |
| 6 | |
| 6 | |
| 6 | |
| 5 | |
| 5 | |
| 5 | |
| 4 | |
| 4 | |
| 4 | |
| 4 | |
| 4 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.
WordPress Plugins with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| 10Web Booster – Website speed optimization, Cache & Page Speed optimizer | tenweb-speed-optimizer |
| Accessiy by CodeConfig – Accessibility Widgets for ADA, EAA & WCAG Compliance | codeconfig-accessibility |
| Actionwear products sync | actionwear-products-sync |
| Add Custom Codes – Insert Header, Footer, Custom PHP Snippets, CSS, Javascript | add-custom-codes |
| Advanced Custom Fields: Extended | acf-extended |
| Advanced FAQ Manager | advanced-faq-manager |
| All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic | all-in-one-seo-pack |
| All-in-One Video Gallery | all-in-one-video-gallery |
| Application Passwords | application-passwords |
| Arconix Shortcodes | arconix-shortcodes |
| ARK Related Posts | ark-relatedpost |
| Auto Alt Text | auto-alt-text |
| Auto Thumbnailer | auto-thumbnailer |
| Autoptimize | autoptimize |
| Backup, Restore and Migrate your sites with XCloner | xcloner-backup-and-restore |
| Beaver Builder Page Builder – Drag and Drop Website Builder | beaver-builder-lite-version |
| BlockArt Blocks – Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library | blockart-blocks |
| Booking Calendar | booking |
| Bread & Butter: AI Lead Intelligence Engine | bread-butter |
| Business Directory Plugin – Easy Listing Directories for WordPress | business-directory-plugin |
| Canadian Nutrition Facts Label | canadian-nutrition-facts-label |
| Chartify – WordPress Chart Plugin | chart-builder |
| Clik stats | clikstats |
| Constant Contact + WooCommerce | constant-contact-woocommerce |
| Contact Form by BestWebSoft – Advanced WP Contact Form Builder for WordPress | contact-form-plugin |
| Contact Form Email | contact-form-to-email |
| ContentStudio | contentstudio |
| Cool Tag Cloud | cool-tag-cloud |
| CoSign Single Signon | cosign-sso |
| Cost Calculator Builder | cost-calculator-builder |
| CRM Memberships | crm-memberships |
| CryptX | cryptx |
| CSS3 Buttons | css3-buttons |
| CSSIgniter Shortcodes | cssigniter-shortcodes |
| CSV Sumotto | csv-sumotto |
| Custom Layouts – Post + Product grids made easy | custom-layouts |
| Custom Post Type UI | custom-post-type-ui |
| Custom Sidebars by ProteusThemes | custom-sidebars-by-proteusthemes |
| Cute News Ticker | cute-news-ticker |
| Demo Importer Plus | demo-importer-plus |
| DesignThemes LMS | designthemes-lms |
| dream gallery | dream-gallery |
| Easy Jump Links Menus | easy-jump-links-menus |
| ELEX WordPress HelpDesk & Customer Ticketing System | elex-helpdesk-customer-support-ticket-system |
| Envo Extra | envo-extra |
| EPROLO-Dropshipping | eprolo-dropshipping |
| Ergonet Cache | ergonet-varnish-cache |
| ERP: Complete HR, Accounting & CRM Suite with Recruitment and WooCommerce CRM Support | erp |
| Event Booking Manager for WooCommerce | mage-eventpress |
| Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin | everest-backup |
| Export All Posts, Products, Orders, Refunds & Users | wp-ultimate-exporter |
| Extra Post Images | extra-post-images |
| Featured Image via URL | featured-image-via-url |
| Feedback Modal for Website | feedback-modal-for-website |
| Feeds for TikTok – Display Video Feeds in Grid Layouts | b-tiktok-feed |
| FitVids for WordPress | fitvids-for-wordpress |
| Flex QR Code Generator | flex-qr-code-generator |
| Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution | fluent-booking |
| Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder | fluentform |
| FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler | fluent-cart |
| Formstack Online Forms | formstack |
| Frontend Admin by DynamiApps | acf-frontend-form-element |
| FunnelKit – Funnel Builder for WooCommerce Checkout | funnel-builder |
| g-FFL Cockpit | g-ffl-cockpit |
| Generic Elements | generic-elements-for-elementor |
| Get Cash | get-cash |
| Gravitec.net – Web Push Notifications | gravitec-net-web-push-notifications |
| Gravity Forms | gravityforms |
| GSheetConnector For WPForms – WPForms Google Sheets Integration (Real-Time Sync) | gsheetconnector-wpforms |
| Gutenverse News – News Blocks for Blog & Magazine Sites | gutenverse-news |
| Happy Addons for Elementor | happy-elementor-addons |
| Hide Categories Or Products On Shop Page | hide-categories-or-products-on-shop-page |
| HUSKY – Products Filter Professional for WooCommerce | woocommerce-products-filter |
| Hype | pico |
| Image Cleanup | image-cleanup |
| Image Optimizer by wps.sk | image-optimizer-wpssk |
| Jabbernotification | jabberbenachrichtigung |
| JNews Gallery | jnews-gallery |
| JNews Paywall | jnews-paywall |
| Kadence WooCommerce Email Designer | kadence-woocommerce-email-designer |
| Link Whisper Free | link-whisper |
| List Attachments Shortcode | list-attachments-shortcode |
| Listar – Directory Listing & Classifieds WordPress Plugin | listar-directory-listing |
| Live CSS Preview | live-css-preview |
| Live Sales Notification for Woocommerce – Woomotiv | woomotiv |
| Make Section & Column Clickable For Elementor | make-section-column-clickable-elementor |
| Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits | master-addons |
| Media Library Downloader | media-library-downloader |
| Modula Image Gallery – Photo Grid & Video Gallery | modula-best-grid-gallery |
| MultiParcels Shipping For WooCommerce | multiparcels-shipping-for-woocommerce |
| MxChat – AI Chatbot & Content Generation for WordPress | mxchat-basic |
| My auctions allegro | my-auctions-allegro-free-edition |
| My Tickets – Accessible Event Ticketing | my-tickets |
| myLCO | mylco |
| Nexter Extension – Security, Performance, Code Snippets & Site Toolkit | nexter-extension |
| Norby AI | norby-ai |
| Nouri.sh Newsletter | newsletters-from-rss-to-email-newsletters-using-nourish |
| Omnichannel for WooCommerce: Google, Amazon, eBay & Walmart Integration – Powered by Codisto | codistoconnect |
| Omnipress | omnipress |
| Order Delivery Date for WooCommerce | order-delivery-date-for-woocommerce |
| Payaza | payaza |
| Paysera Payment Gateway for WooCommerce | woo-payment-gateway-paysera |
| PDF Catalog for WooCommerce | pdf-catalog-for-woocommerce |
| PDF Invoices & Packing Slips for WooCommerce | woocommerce-pdf-invoices-packing-slips |
| PDF Thumbnail Generator | pdf-thumbnail-generator |
| Photo Gallery by Ays – Responsive Image Gallery | gallery-photo-gallery |
| Plug your WooCommerce into the largest catalog of customized print products from Helloprint | helloprint |
| Portfolio and Projects | portfolio-and-projects |
| Post Cloner | post-cloner |
| Post Grid | post-grid |
| Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App | post-smtp |
| PostGallery | postgallery |
| Premium Addons for Elementor – Powerful Elementor Templates & Widgets | premium-addons-for-elementor |
| Projectopia – Project Management Tool | projectopia-core |
| Quantic Social Image Hover | tw-image-hover-share |
| Quiz Maker by AYS | quiz-maker |
| reHub Framework | rehub-framework |
| RevInsite | revinsite |
| Rich Showcase for Google Reviews | widget-google-reviews |
| Salon Booking System – Free Version | salon-booking-system |
| Search, Filters & Merchandising for WooCommerce | instantsearch-for-woocommerce |
| SendPulse Email Marketing Newsletter | sendpulse-email-marketing-newsletter |
| Sermon Manager | sermon-manager-for-wordpress |
| ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution | shopengine |
| SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery | sms-alert |
| SMTP Mail | smtp-mail |
| Social Feed Gallery Portfolio | social-feed-gallery-portfolio |
| SSP Debug | ssp-debugging |
| Starter Templates – AI-Powered Templates for Elementor & Gutenberg | astra-sites |
| SureMail – SMTP and Email Logs Plugin with Amazon SES, Postmark, and Other Providers | suremails |
| SurveyFunnel – Survey Plugin for WordPress | surveyfunnel-lite |
| SurveyJS: Drag & Drop Form Builder | surveyjs |
| SV100 Companion | sv100-companion |
| Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent | tablesome |
| Tag, Category, and Taxonomy Manager – Autotagger Automatically Add Terms | simple-tags |
| Takeads | monetize-link |
| Thai Lottery Widget | thai-lottery-widget |
| Thank You Page Customizer for WooCommerce – Increase Your Sales | woo-thank-you-page-customizer |
| The7 Elements | dt-the7-core |
| Thim Kit for Elementor – Pre-built Templates & Widgets for Elementor | thim-elementor-kit |
| Time Sheets | time-sheets |
| Torod – The smart shipping and delivery portal for e-shops and retailers | torod |
| TR Timthumb | tr-timthumb |
| Trail Manager | trail-manager |
| Twitscription | twitscription |
| Ultra Skype Button | ultra-skype-button |
| User Generator and Importer | user-importer-and-generator |
| User Spam Remover | user-spam-remover |
| User Verification by PickPlugins | user-verification |
| VikRentCar Car Rental Management System | vikrentcar |
| Visualizer – Tables & Charts Manager with Built-in AI Generator | visualizer |
| Voidek Employee Portal | voidek-employee-portal |
| WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors | wc-vendors |
| Webcake – Landing Page Builder | webcake |
| WebP Express | webp-express |
| weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot | wedocs |
| Weekly Planner | weekly-planner |
| Widgets for Google Reviews | wp-reviews-plugin-for-google |
| WP AI CoPilot – AI content writer plugin, ChatGPT WordPress, GPT-3/4 , Ai assistance | ai-co-pilot-for-wp |
| WP Directory Kit | wpdirectorykit |
| WP Google Analytics Events – No-Code Custom Event Tracking for Google Analytics | wp-google-analytics-events |
| WP Landing Page | wp-landing-page |
| Wp Social Login and Register Social Counter | wp-social |
| WP Social Ninja – Embed Social Feeds, User Reviews & Chat Widgets | wp-social-reviews |
| WP Ultimate Review | wp-ultimate-review |
| WP-SOS-Donate Donation Sidebar Plugin | wp-sos-donate |
| WPKoi Templates for Elementor | wpkoi-templates-for-elementor |
| WPS Bidouille | wps-bidouille |
| WPZOOM Addons for Elementor – Starter Templates & Widgets | wpzoom-elementor-addons |
| Xagio SEO – AI Powered SEO | xagio-seo |
| Xpro Addons — 140+ Widgets for Elementor | xpro-elementor-addons |
| Yandex.Metrica | wp-yandex-metrika |
| Yet Another WebClap for WordPress | yet-another-webclap-for-wordpress |
| Zigaform – Price Calculator & Cost Estimation Form Builder Lite | zigaform-calculator-cost-estimation-form-builder-lite |
WordPress Themes with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| AdForest | adforest |
| REHub - Price Comparison, Multi Vendor Marketplace Wordpress Theme | rehub-theme |
Vulnerability Details
Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.
Affected Software
WP Directory Kit [wpdirectorykit]
Researcher
Affected Software
Advanced Custom Fields: Extended [acf-extended]
Researcher
Affected Software
CRM Memberships [crm-memberships]
Researcher
Affected Software
DesignThemes LMS [designthemes-lms]
Researcher
Affected Software
User Verification by PickPlugins [user-verification]
Researcher
Affected Software
Flex QR Code Generator [flex-qr-code-generator]
Researcher
Affected Software
Frontend Admin by DynamiApps [acf-frontend-form-element]
Researcher
Affected Software
SV100 Companion [sv100-companion]
Researcher
Affected Software
10Web Booster – Website speed optimization, Cache & Page Speed optimizer [tenweb-speed-optimizer]
Researcher
Affected Software
All-in-One Video Gallery [all-in-one-video-gallery]
Researcher
Affected Software
Auto Thumbnailer [auto-thumbnailer]
Researcher
Affected Software
ContentStudio [contentstudio]
Researcher
Affected Software
Cost Calculator Builder [cost-calculator-builder]
Researcher
Demo Importer Plus <= 2.0.6 - Authenticated (Author+) Arbitrary File Upload via WXR Upload Bypass
8.8
Affected Software
Demo Importer Plus [demo-importer-plus]
Researcher
Affected Software
Featured Image via URL [featured-image-via-url]
Researcher
Affected Software
PostGallery [postgallery]
Researcher
Starter Templates <= 4.4.41 - Authenticated (Author+) Arbitrary File Upload via WXR Upload Bypass
8.8
Affected Software
Researcher
Affected Software
User Generator and Importer [user-importer-and-generator]
Researcher
Affected Software
Cool Tag Cloud [cool-tag-cloud]
Researcher
Affected Software
My auctions allegro [my-auctions-allegro-free-edition]
Researcher
Affected Software
Researcher
Affected Software
Modula Image Gallery – Photo Grid & Video Gallery [modula-best-grid-gallery]
Researcher
Affected Software
My auctions allegro [my-auctions-allegro-free-edition]
Researcher
Affected Software
The7 Elements [dt-the7-core]
Researcher
Affected Software
VikRentCar Car Rental Management System [vikrentcar]
Researcher
Affected Software
Kadence WooCommerce Email Designer [kadence-woocommerce-email-designer]
Researcher
Affected Software
Modula Image Gallery – Photo Grid & Video Gallery [modula-best-grid-gallery]
Researcher
Affected Software
Researcher
Affected Software
Rich Showcase for Google Reviews [widget-google-reviews]
Researcher
Affected Software
Time Sheets [time-sheets]
Researcher
Affected Software
Widgets for Google Reviews [wp-reviews-plugin-for-google]
Researcher
Affected Software
All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic [all-in-one-seo-pack]
Researcher
Affected Software
Export All Posts, Products, Orders, Refunds & Users [wp-ultimate-exporter]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Advanced FAQ Manager [advanced-faq-manager]
Researcher
Affected Software
Arconix Shortcodes [arconix-shortcodes]
Researcher
Affected Software
Autoptimize [autoptimize]
Researcher
Affected Software
Researcher
Affected Software
Booking Calendar [booking]
Researcher
Affected Software
Canadian Nutrition Facts Label [canadian-nutrition-facts-label]
Researcher
Affected Software
CryptX [cryptx]
Researcher
Affected Software
CSS3 Buttons [css3-buttons]
Researcher
Affected Software
CSSIgniter Shortcodes [cssigniter-shortcodes]
Researcher
Affected Software
Cute News Ticker [cute-news-ticker]
Researcher
Affected Software
Easy Jump Links Menus [easy-jump-links-menus]
Researcher
Affected Software
Envo Extra [envo-extra]
Researcher
Affected Software
Extra Post Images [extra-post-images]
Researcher
Funnel Builder by FunnelKit <= 3.13.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
FunnelKit – Funnel Builder for WooCommerce Checkout [funnel-builder]
Researcher
Affected Software
Generic Elements [generic-elements-for-elementor]
Researcher
Affected Software
JNews Gallery [jnews-gallery]
Researcher
Affected Software
List Attachments Shortcode [list-attachments-shortcode]
Researcher
Master Addons for Elementor <= 2.0.9.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
Researcher
Nexter Extension <= 4.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
6.4
Affected Software
Nexter Extension – Security, Performance, Code Snippets & Site Toolkit [nexter-extension]
Researcher
Affected Software
RevInsite [revinsite]
Researcher
Affected Software
Sermon Manager [sermon-manager-for-wordpress]
Researcher
Affected Software
Social Feed Gallery Portfolio [social-feed-gallery-portfolio]
Researcher
Affected Software
SurveyFunnel – Survey Plugin for WordPress [surveyfunnel-lite]
Researcher
Affected Software
Thai Lottery Widget [thai-lottery-widget]
Researcher
Affected Software
TR Timthumb [tr-timthumb]
Researcher
Affected Software
WP Ultimate Review [wp-ultimate-review]
Researcher
Affected Software
Ultra Skype Button [ultra-skype-button]
Researcher
WPZOOM Addons for Elementor <= 1.2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
WPZOOM Addons for Elementor – Starter Templates & Widgets [wpzoom-elementor-addons]
Researcher
Affected Software
Xpro Addons — 140+ Widgets for Elementor [xpro-elementor-addons]
Researcher
Affected Software
Yet Another WebClap for WordPress [yet-another-webclap-for-wordpress]
Researcher
Affected Software
ELEX WordPress HelpDesk & Customer Ticketing System [elex-helpdesk-customer-support-ticket-system]
Researcher
Affected Software
Clik stats [clikstats]
Researcher
Affected Software
CoSign Single Signon [cosign-sso]
Researcher
Affected Software
CSV Sumotto [csv-sumotto]
Researcher
Affected Software
dream gallery [dream-gallery]
Researcher
Affected Software
Jabbernotification [jabberbenachrichtigung]
Researcher
Affected Software
Link Whisper Free [link-whisper]
Researcher
Affected Software
Researcher
Affected Software
myLCO [mylco]
Researcher
Affected Software
Nouri.sh Newsletter [newsletters-from-rss-to-email-newsletters-using-nourish]
Researcher
Affected Software
Twitscription [twitscription]
Researcher
Affected Software
WP Social Ninja – Embed Social Feeds, User Reviews & Chat Widgets [wp-social-reviews]
Researcher
Affected Software
WP-SOS-Donate Donation Sidebar Plugin [wp-sos-donate]
Researcher
Affected Software
Application Passwords [application-passwords]
Researcher
Affected Software
PDF Catalog for WooCommerce [pdf-catalog-for-woocommerce]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Accessiy by CodeConfig – Accessibility Widgets for ADA, EAA & WCAG Compliance [codeconfig-accessibility]
Researcher
Affected Software
AdForest [adforest]
Researcher
Affected Software
Constant Contact + WooCommerce [constant-contact-woocommerce]
Researcher
Affected Software
Contact Form Email [contact-form-to-email]
Researcher
CRM Memberships <= 2.5 - Missing Authorization to Unauthenticated 'ntzcrm_add_new_tag' AJAX Action
5.3
Affected Software
CRM Memberships [crm-memberships]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Feedback Modal for Website [feedback-modal-for-website]
Researcher
Affected Software
Researcher
Affected Software
Formstack Online Forms [formstack]
Researcher
Affected Software
g-FFL Cockpit [g-ffl-cockpit]
Researcher
Affected Software
g-FFL Cockpit [g-ffl-cockpit]
Researcher
Affected Software
WP Google Analytics Events – No-Code Custom Event Tracking for Google Analytics [wp-google-analytics-events]
Researcher
Helloprint <= 2.1.2 - Missing Authorization to Unauthenticated Arbitrary Order Status Modification
5.3
Affected Software
Researcher
Affected Software
Image Cleanup [image-cleanup]
Researcher
Affected Software
MxChat – AI Chatbot & Content Generation for WordPress [mxchat-basic]
Researcher
Affected Software
Order Delivery Date for WooCommerce [order-delivery-date-for-woocommerce]
Researcher
Affected Software
Payaza [payaza]
Researcher
Affected Software
Post Cloner [post-cloner]
Researcher
Affected Software
Post Grid [post-grid]
Researcher
Affected Software
Premium Addons for Elementor – Powerful Elementor Templates & Widgets [premium-addons-for-elementor]
Researcher
Affected Software
Projectopia – Project Management Tool [projectopia-core]
Researcher
Affected Software
Researcher
SendPulse Email Marketing Newsletter <= 2.2.1 - Authenticated (Subscriber+) Information Exposure
5.3
Affected Software
SendPulse Email Marketing Newsletter [sendpulse-email-marketing-newsletter]
Researcher
Affected Software
Researcher
Affected Software
SSP Debug [ssp-debugging]
Researcher
Affected Software
SurveyFunnel – Survey Plugin for WordPress [surveyfunnel-lite]
Researcher
Affected Software
Feeds for TikTok – Display Video Feeds in Grid Layouts [b-tiktok-feed]
Researcher
Affected Software
User Spam Remover [user-spam-remover]
Researcher
Affected Software
Voidek Employee Portal [voidek-employee-portal]
Researcher
Affected Software
WebP Express [webp-express]
Researcher
Affected Software
Wp Social Login and Register Social Counter [wp-social]
Researcher
Affected Software
Event Booking Manager for WooCommerce [mage-eventpress]
Researcher
Affected Software
GSheetConnector For WPForms – WPForms Google Sheets Integration (Real-Time Sync) [gsheetconnector-wpforms]
Researcher
Affected Software
Yandex.Metrica [wp-yandex-metrika]
Researcher
Affected Software
Zigaform – Price Calculator & Cost Estimation Form Builder Lite [zigaform-calculator-cost-estimation-form-builder-lite]
Researcher
Affected Software
Researcher
Affected Software
WP Directory Kit [wpdirectorykit]
Researcher
Affected Software
Custom Post Type UI [custom-post-type-ui]
Researcher
Affected Software
FitVids for WordPress [fitvids-for-wordpress]
Researcher
Affected Software
Make Section & Column Clickable For Elementor [make-section-column-clickable-elementor]
Researcher
Affected Software
Trail Manager [trail-manager]
Researcher
Affected Software
Weekly Planner [weekly-planner]
Researcher
Affected Software
Accessiy by CodeConfig – Accessibility Widgets for ADA, EAA & WCAG Compliance [codeconfig-accessibility]
Researcher
Affected Software
Actionwear products sync [actionwear-products-sync]
Researcher
Affected Software
Researcher
Affected Software
WP AI CoPilot – AI content writer plugin, ChatGPT WordPress, GPT-3/4 , Ai assistance [ai-co-pilot-for-wp]
Researcher
Affected Software
ARK Related Posts [ark-relatedpost]
Researcher
Affected Software
Auto Alt Text [auto-alt-text]
Researcher
Affected Software
Backup, Restore and Migrate your sites with XCloner [xcloner-backup-and-restore]
Researcher
Affected Software
Beaver Builder Page Builder – Drag and Drop Website Builder [beaver-builder-lite-version]
Affected Software
Beaver Builder Page Builder – Drag and Drop Website Builder [beaver-builder-lite-version]
Researcher
Affected Software
Bread & Butter: AI Lead Intelligence Engine [bread-butter]
Researcher
Affected Software
Business Directory Plugin – Easy Listing Directories for WordPress [business-directory-plugin]
Researcher
Affected Software
Chartify – WordPress Chart Plugin [chart-builder]
Researcher
Affected Software
Contact Form by BestWebSoft – Advanced WP Contact Form Builder for WordPress [contact-form-plugin]
Researcher
Affected Software
ContentStudio [contentstudio]
Researcher
Affected Software
Custom Layouts – Post + Product grids made easy [custom-layouts]
Researcher
Affected Software
Custom Sidebars by ProteusThemes [custom-sidebars-by-proteusthemes]
Researcher
Affected Software
EPROLO-Dropshipping [eprolo-dropshipping]
Researcher
Affected Software
Ergonet Cache [ergonet-varnish-cache]
Researcher
Affected Software
Researcher
Affected Software
Gravitec.net – Web Push Notifications [gravitec-net-web-push-notifications]
Researcher
Affected Software
Gutenverse News – News Blocks for Blog & Magazine Sites [gutenverse-news]
Researcher
Affected Software
Happy Addons for Elementor [happy-elementor-addons]
Researcher
Hide Categories Or Products On Shop Page <= 1.0.7 - Cross-Site Request Forgery to Settings Update
4.3
Affected Software
Hide Categories Or Products On Shop Page [hide-categories-or-products-on-shop-page]
Researcher
Affected Software
HUSKY – Products Filter Professional for WooCommerce [woocommerce-products-filter]
Researcher
Affected Software
Image Cleanup [image-cleanup]
Researcher
Affected Software
Image Optimizer by wps.sk [image-optimizer-wpssk]
Researcher
Affected Software
JNews Paywall [jnews-paywall]
Researcher
Affected Software
Listar – Directory Listing & Classifieds WordPress Plugin [listar-directory-listing]
Researcher
Affected Software
Listar – Directory Listing & Classifieds WordPress Plugin [listar-directory-listing]
Researcher
Live CSS Preview <= 2.1.4 - Missing Authorization to Authenticated (Subscriber+) Settings Update
4.3
Affected Software
Live CSS Preview [live-css-preview]
Researcher
Affected Software
Media Library Downloader [media-library-downloader]
Researcher
Affected Software
MultiParcels Shipping For WooCommerce [multiparcels-shipping-for-woocommerce]
Researcher
Affected Software
My Tickets – Accessible Event Ticketing [my-tickets]
Researcher
Affected Software
Norby AI [norby-ai]
Researcher
Affected Software
PDF Thumbnail Generator [pdf-thumbnail-generator]
Researcher
Affected Software
Photo Gallery by Ays – Responsive Image Gallery [gallery-photo-gallery]
Researcher
Affected Software
Portfolio and Projects [portfolio-and-projects]
Researcher
Affected Software
Projectopia – Project Management Tool [projectopia-core]
Researcher
Affected Software
Quantic Social Image Hover [tw-image-hover-share]
Researcher
Affected Software
Quiz Maker by AYS [quiz-maker]
Researcher
Affected Software
reHub Framework [rehub-framework]
Researcher
Affected Software
Salon Booking System – Free Version [salon-booking-system]
Researcher
Affected Software
Search, Filters & Merchandising for WooCommerce [instantsearch-for-woocommerce]
Researcher
Affected Software
Researcher
Affected Software
SMTP Mail [smtp-mail]
Researcher
Affected Software
SurveyJS: Drag & Drop Form Builder [surveyjs]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Takeads [monetize-link]
Researcher
Affected Software
Thank You Page Customizer for WooCommerce – Increase Your Sales [woo-thank-you-page-customizer]
Researcher
Affected Software
Thim Kit for Elementor – Pre-built Templates & Widgets for Elementor [thim-elementor-kit]
Researcher
Affected Software
Time Sheets [time-sheets]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Webcake – Landing Page Builder [webcake]
Researcher
Affected Software
Paysera Payment Gateway for WooCommerce [woo-payment-gateway-paysera]
Researcher
Affected Software
PDF Invoices & Packing Slips for WooCommerce [woocommerce-pdf-invoices-packing-slips]
Researcher
Affected Software
WP Landing Page [wp-landing-page]
Researcher
Affected Software
Event Booking Manager for WooCommerce [mage-eventpress]
Researcher
Affected Software
WPKoi Templates for Elementor [wpkoi-templates-for-elementor]
Researcher
Affected Software
WPS Bidouille [wps-bidouille]
Researcher
Affected Software
Xagio SEO – AI Powered SEO [xagio-seo]
Researcher
As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.
This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
Comments