Wordfence Intelligence Weekly WordPress Vulnerability Report (January 12, 2026 to January 18, 2026)
📢 Did you know Wordfence runs a Bug Bounty Program for all WordPress plugin and themes at no cost to vendors? Researchers can earn up to $31,200 per vulnerability, for all in-scope vulnerabilities submitted to our Bug Bounty Program! Find a vulnerability, submit the details directly to us, and we handle all the rest.
Last week, there were 222 vulnerabilities disclosed in 169 WordPress Plugins and 42 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 79 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.
Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back.
Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 32,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
New Firewall Rules Deployed Last Week
The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.
The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:
-
-
- LA-Studio Element Kit for Elementor <= 1.5.6.3 – Unauthenticated Privilege Escalation via Backdoor to Administrative User Creation via lakit_bkrole parameter
- Modular Connector (Modular DS) <= 2.5.1 – Missing Authentication to Privilege Escalation
- Academy LMS – WordPress LMS Plugin for Complete eLearning Solution <= 3.5.0 – Unauthenticated Privilege Escalation via Account Takeover
- WAF-RULE-890 – Data redacted while we work with the vendor on a patch.
-
Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.
Total Unpatched & Patched Vulnerabilities Last Week
| Patch Status | Number of Vulnerabilities |
|---|---|
| Patched | 112 |
| Unpatched | 110 |
Total Vulnerabilities by CVSS Severity Last Week
| Severity Rating | Number of Vulnerabilities |
|---|---|
| Low Severity | 2 |
| Medium Severity | 155 |
| High Severity | 50 |
| Critical Severity | 15 |
Total Vulnerabilities by CWE Type Last Week
| Vulnerability Type by CWE | Number of Vulnerabilities |
|---|---|
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 62 |
| Missing Authorization | 60 |
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | 20 |
| Cross-Site Request Forgery (CSRF) | 10 |
| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 10 |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 10 |
| Unrestricted Upload of File with Dangerous Type | 9 |
| Exposure of Sensitive Information to an Unauthorized Actor | 8 |
| Deserialization of Untrusted Data | 7 |
| Authorization Bypass Through User-Controlled Key | 4 |
| Server-Side Request Forgery (SSRF) | 4 |
| Improper Control of Generation of Code ('Code Injection') | 3 |
| Improper Privilege Management | 3 |
| Authentication Bypass Using an Alternate Path or Channel | 2 |
| Incorrect Authorization | 2 |
| Client-Side Enforcement of Server-Side Security | 1 |
| Improper Input Validation | 1 |
| Improper Restriction of XML External Entity Reference | 1 |
| Incorrect Privilege Assignment | 1 |
| Insufficient Verification of Data Authenticity | 1 |
| Missing Authentication for Critical Function | 1 |
| Relative Path Traversal | 1 |
| Unverified Password Change | 1 |
Researchers That Contributed to WordPress Security Last Week
| Researcher Name | Number of Vulnerabilities |
|---|---|
| 36 | |
| 15 | |
| 11 | |
| 10 | |
| 9 | |
| 8 | |
| 7 | |
| 7 | |
| 5 | |
| 5 | |
| 4 | |
| 4 | |
| 4 | |
| 4 | |
| 4 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.
WordPress Plugins with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| Accordion Slider PRO | accordion_slider_pro |
| Advanced Ads – Ad Manager & AdSense | advanced-ads |
| AffiliateX – Amazon Affiliate Plugin, Product Boxes, Comparison Tables & Affiliate Link Tracking | affiliatex |
| AJAX Hits Counter + Popular Posts Widget | ajax-hits-counter |
| AJS Footnotes | ajs-footnotes |
| All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) | all-in-one-seo-pack |
| All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos | all-in-one-video-gallery |
| Alma – Pay in installments or later for WooCommerce | alma-gateway-for-woocommerce |
| Antideo Email Validator | antideo-email-validator |
| Aplazo Payment Gateway | aplazo-payment-gateway |
| Auto Post to Social Media from Social Champ | auto-post-to-social-media-wp-to-social-champ |
| Avada (Fusion) Builder | fusion-builder |
| Awesome Support – WordPress HelpDesk & Support Plugin | awesome-support |
| AWP Classifieds | another-wordpress-classifieds-plugin |
| Bayarcash WooCommerce | bayarcash-wc |
| Best-wp-google-map | best-wp-google-map |
| bidorbuy Store Integrator | bidorbuystoreintegrator |
| Booking Calendar | booking |
| Breeze Cache | breeze |
| Cargus | cargus |
| Church Admin | church-admin |
| CleverReach® WP | cleverreach-wp |
| Client Portal – Private user pages and login | client-portal |
| CM Business Directory – Optimise and showcase local business | cm-business-directory |
| CM E-Mail Blacklist – Simple email filtering for safer registration | cm-email-blacklist |
| Community Events | community-events |
| Cost Calculator Builder | cost-calculator-builder |
| CP Image Store with Slideshow | cp-image-store |
| Crush.pics Image Optimizer – Image Compression and Optimization | crush-pics |
| CubeWP Framework | cubewp-framework |
| DASHBOARD BUILDER – WordPress plugin for Charts and Graphs | dashboard-builder |
| Demo Importer Plus | demo-importer-plus |
| DK PDF – WordPress PDF Generator | dk-pdf |
| Dooodl | dooodl |
| Drag and Drop Multiple File Upload for Contact Form 7 | drag-and-drop-multiple-file-upload-contact-form-7 |
| DZS Video Gallery | dzs-videogallery |
| Ecwid by Lightspeed Ecommerce Shopping Cart | ecwid-shopping-cart |
| Electric Studio Download Counter | electric-studio-download-counter |
| Element Invader – Template Kits for Elementor | elementinvader |
| Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons | bdthemes-element-pack-lite |
| Eli's WordCents adSense Widget with Analytics | wordcents |
| Essential Addons for Elementor – Popular Elementor Templates & Widgets | essential-addons-for-elementor-lite |
| Event Espresso – Event Registration & Ticketing Sales | event-espresso-decaf |
| Event Tickets with Ticket Scanner | event-tickets-with-ticket-scanner |
| EventPrime – Events Calendar, Bookings and Tickets | eventprime-event-calendar-management |
| Filr – Secure document library | filr-protection |
| Flex QR Code Generator | flex-qr-code-generator |
| Float Payment Gateway | float-gateway |
| Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder | fluentform |
| Frontend File Manager Plugin | nmedia-user-file-uploader |
| g-FFL Checkout | g-ffl-checkout |
| Geeky Bot – AI Sales Assistant for WooCommerce | geeky-bot |
| GetContentFromURL | getcontentfromurl |
| GetGenie – AI SEO Assistant & Content Writer with Keyword Research, AEO & GEO | getgenie |
| Gotham Block Extra Light | gotham-block-extra-light |
| HDForms | Contact Form Builder | hdforms |
| Hide My WP - Amazing Security Plugin for WordPress! | hide_my_wp |
| Houzez Theme - Functionality | houzez-theme-functionality |
| Hyyan WooCommerce Polylang Integration | woo-poly-integration |
| Infility Global | infility-global |
| Integrate Dynamics 365 CRM | integrate-dynamics-365-crm |
| Integration Opvius AI for WooCommerce | woosa-ai-for-woocommerce |
| Internal Link Builder | internal-link-builder |
| JNews - Frontend Submit | jnews-frontend-submit |
| JNews - Pay Writer | jnews-pay-writer |
| JNews - Video | jnews-video |
| Jupiter X Core | jupiterx-core |
| Kunze Law | kunze-law |
| Laurent Core | laurent-core |
| LearnPress – Course Review | learnpress-course-review |
| LEAV Last Email Address Validator | last-email-address-validator |
| LinkedIn SC | linkedin-sc |
| List Site Contributors | list-site-contributors |
| LottieFiles | lottiefiles |
| Makesweat | makesweat |
| Membership Plugin – Kadence Memberships | restrict-content |
| Modular DS: Monitor, update, and backup multiple websites | modular-connector |
| Multilanguage by BestWebSoft – WordPress Translation Plugin and Language Switcher | multilanguage |
| Name Directory | name-directory |
| Netcash WooCommerce Payment Gateway | netcash-pay-now-payment-gateway-for-woocommerce |
| News and Blog Designer Bundle | news-and-blog-designer-bundle |
| NextMove Lite – Thank You Page for WooCommerce | woo-thank-you-page-nextmove-lite |
| Ninja Tables – Easy Data Table Builder | ninja-tables |
| NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar | notificationx |
| Omnichannel for WooCommerce: Google, Amazon, eBay & Walmart Integration – Powered by Codisto | codistoconnect |
| onepay Payment Gateway For WooCommerce | onepay-payment-gateway-for-woocommerce |
| PAYGENT for WooCommerce | woocommerce-for-paygent-payment-main |
| PayHere Payment Gateway | payhere-payment-gateway |
| Payment Button for PayPal | wp-paypal |
| PDF Resume Parser | pdf-resume-parser |
| Peach Payments Gateway | wc-peach-payments-gateway |
| Penci Pay Writer | penci-pay-writer |
| Penci Review | penci-review |
| Perfit WooCommerce | perfit-woocommerce |
| Phrase TMS Integration for WordPress | memsource-connector |
| Post Slides | post-slides |
| Premium Addons for Elementor – Elementor Templates, Widgets & MCP Tools | premium-addons-for-elementor |
| Quick Contact Form | quick-contact-form |
| Quote Master | quote-master |
| Real Post Slider Lite | real-post-slider-lite |
| RealPress – Real Estate Plugin | realpress |
| Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit | woo-rede |
| Registration & Login with Mobile Phone Number for WooCommerce | registration-login-with-mobile-phone-number |
| RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login | custom-registration-form-builder-with-submission-manager |
| Related Posts by Taxonomy | related-posts-by-taxonomy |
| Related Posts Thumbnails Plugin for WordPress | related-posts-thumbnails |
| RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress | computer-repair-shop |
| Reservation Plugin | dt-reservation-plugin |
| Responsive Accordion Slider | responsive-accordion-slider |
| Responsive Addons for Elementor – Free Elementor Addons, Kits and Elementor Templates | responsive-addons-for-elementor |
| Sales Countdown Timer for WooCommerce and WordPress | sctv-sales-countdown-timer |
| SearchWiz | searchwiz |
| Seriously Simple Podcasting | seriously-simple-podcasting |
| Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning | wp-simple-firewall |
| Shipping Rate By Cities | shipping-rate-by-cities |
| Shipping Rates by City for WooCommerce | flat-shipping-rate-by-city-for-woocommerce |
| Short Link | short-link |
| Shown Connector | shown-connector |
| Simple GDPR Cookie Compliance | simple-gdpr-cookie-compliance |
| Simply Schedule Appointments | simply-schedule-appointments |
| Smart Product Viewer | smart-product-viewer |
| Sosh Share Buttons | sosh-share-buttons |
| Spectra Legacy – Gutenberg Blocks | ultimate-addons-for-gutenberg |
| SpiceForms Form Builder | spiceforms-form-builder |
| Spin Wheel – Interactive spinning wheel that offers coupons | spin-wheel |
| Stopwords for comments | stopwords-for-comments |
| Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder | supreme-modules-for-divi |
| Synergy Project Manager | synergy-project-manager |
| Syntax Highlighter Compress | syntax-highlighter-compress |
| Team Section Block – introduce your team with beautiful layouts | team-section |
| Testimonials Creator | testimonials-creator |
| The Guardian News Feed | the-guardian-news-feed |
| Thim Blocks | thim-blocks |
| Tickera – Sell Tickets & Manage Events | tickera-event-ticketing-system |
| Turn Yoast SEO FAQ Block to Accordion | faq-schema-block-to-accordion |
| Tutor LMS Pro | tutor-pro |
| UiChemy — Figma Converter for Elementor, Gutenberg and Bricks | uichemy |
| Universal Google Adsense and Ads manager | universal-google-adsense-and-ads-manager |
| User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor | profile-builder |
| User Registration Using Contact Form 7 | user-registration-using-contact-form-7 |
| User Submitted Posts – Enable Users to Submit Posts from the Front End | user-submitted-posts |
| Visual Link Preview | visual-link-preview |
| Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments | wallet-system-for-woocommerce |
| WDV One Page Docs – Documentation Plugin for WordPress | wdv-one-page-docs |
| Wheel of Life: Coaching and Assessment Tool for Life Coach | wheel-of-life |
| WMF Mobile Redirector | wmf-mobile-redirector |
| WooCommerce Amazon Affiliates - Wordpress Plugin | woozone |
| Woocommerce Book Price | woo-book-price |
| WooCommerce Frontend Manager – Ultimate | wc-frontend-manager-ultimate |
| Workreap Core | workreap_core |
| WP Allowed Hosts | wp-allow-hosts |
| WP Duplicate Page | wp-duplicate-page |
| WP Hotel Booking | wp-hotel-booking |
| WP Lead Capturing Pages | wp-lead-capture |
| WP Mail | wp-mail |
| WP RSS Aggregator – RSS Import, Feed to Post, Autoblogging, AI Content | wp-rss-aggregator |
| WP Simple Redirect | wp-simple-redirect |
| WP Test Email | wp-test-email |
| WP-CRM System – Manage Clients and Projects | wp-crm-system |
| WP-Members Membership Plugin | wp-members |
| WPBakery Page Builder Addons by Livemesh | addons-for-visual-composer |
| WPBlogSyn | wpblogsync |
| WPLMS Plugin | wplms_plugin |
| WPMasterToolKit (WPMTK) – All in one plugin | wpmastertoolkit |
| Wpresidence Core | wpresidence-core |
| X Addons for Elementor – 20+ Widgets, Templates & Header Footer Builder | x-addons-elementor |
| xPromoter | top_bar_promoter |
| YouTube Feed Pro | youtube-feed-pro |
| Zoho CRM Lead Magnet | zoho-crm-forms |
WordPress Themes with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| Anon - Multipurpose Elementor WooCommerce Themes | anon2x |
| Anona - Pest Control WordPress Theme | anona |
| Auto Repair | auto-repair |
| AutoParts - Car Parts Store WordPress Theme | autoparts |
| bajaar | bajaar |
| Barberry - Modern WooCommerce Theme | barberry |
| Biagiotti | biagiotti |
| Blogistic | blogistic |
| Blogzee | blogzee |
| Brookside | brookside |
| Consult Aid: Business Consulting And Finance PSD | consultaid |
| Dreamer Blog | dreamer-blog |
| Drone Media | Aerial Photography & Videography Theme | drone |
| electron | electron |
| Energia - Renewable Energy WordPress Theme | energia |
| Hostme v2 - Responsive WordPress Theme | hostmev2 |
| Kalium 3 | Creative WordPress & WooCommerce Theme | kalium |
| KenthaRadio - Addon for Kentha Music WordPress Theme To Add Radio Station and Schedule Functionality | qt-kentharadio |
| Kids Heaven - Children Education WordPress Theme | kids-world |
| Laurent - Elegant Restaurant WordPress Theme | laurent |
| Melania | Blog about Handmade & Crafts WordPress Theme + Shop | melania |
| Mella - Minimalist Ajax eCommerce PSD Template | mella |
| Miion | Multi-Purpose WordPress Theme | miion |
| Myour - Personal Portfolio Resume WordPress Theme | myour |
| North - One Page Parallax WordPress Theme | north-wp |
| OneLife - Medical WordPress Theme | onelife |
| Orchid Store | orchid-store |
| Powerlift - Fitness and Gym WordPress Theme | powerlift |
| Promo | promo |
| Reprizo - Jewelry & Watch Store Shopify Theme | reprizo |
| Restaurt | restaurt |
| Right Way | Election Campaign and Political Candidate WordPress Theme | rightway |
| Search & Go - Directory WordPress Theme | search-and-go |
| Skillate | skillate |
| sober | sober |
| Solace | solace |
| The Aisle - Elegant Wedding WordPress Theme | theaisle |
| TheNa - Photography & Portfolio WordPress Theme | thena |
| Travel Monster | travel-monster |
| Wedding Photographer WordPress Theme - Vivagh | vivagh |
| xSmart - App Landing Page WordPress Theme in Tech Presentation, Promo Marketing & Advertising Agency | xsmart |
| XStore | xstore |
Vulnerability Details
Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.
Affected Software
Researcher
Affected Software
Event Tickets with Ticket Scanner [event-tickets-with-ticket-scanner]
Researcher
Affected Software
g-FFL Checkout [g-ffl-checkout]
Researcher
Affected Software
Integration Opvius AI for WooCommerce [woosa-ai-for-woocommerce]
Researcher
Affected Software
Modular DS: Monitor, update, and backup multiple websites [modular-connector]
Researcher
Affected Software
Modular DS: Monitor, update, and backup multiple websites [modular-connector]
Researcher
Affected Software
News and Blog Designer Bundle [news-and-blog-designer-bundle]
Researcher
Affected Software
Registration & Login with Mobile Phone Number for WooCommerce [registration-login-with-mobile-phone-number]
Researcher
Affected Software
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login [custom-registration-form-builder-with-submission-manager]
Researcher
Affected Software
Researcher
Affected Software
Workreap Core [workreap_core]
Researcher
Affected Software
Researcher
Affected Software
HDForms | Contact Form Builder [hdforms]
Researcher
Affected Software
Hostme v2 - Responsive WordPress Theme [hostmev2]
Researcher
Affected Software
WPLMS Plugin [wplms_plugin]
Researcher
Affected Software
All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos [all-in-one-video-gallery]
Researcher
Affected Software
Blogistic [blogistic]
Researcher
Affected Software
Blogzee [blogzee]
Researcher
Affected Software
Researcher
Affected Software
Restaurt [restaurt]
Researcher
Affected Software
Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder [supreme-modules-for-divi]
Researcher
Affected Software
Researcher
Affected Software
Membership Plugin – Kadence Memberships [restrict-content]
Researcher
Affected Software
AutoParts - Car Parts Store WordPress Theme [autoparts]
Researcher
Bajaar - Highly Customizable WooCommerce WordPress <= 2.1.0 - Unauthenticated Local File Inclusion
8.1
Affected Software
bajaar [bajaar]
Researcher
Affected Software
Barberry - Modern WooCommerce Theme [barberry]
Researcher
Affected Software
Biagiotti [biagiotti]
Researcher
Affected Software
Consult Aid: Business Consulting And Finance PSD [consultaid]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
North - One Page Parallax WordPress Theme [north-wp]
Researcher
Affected Software
Powerlift - Fitness and Gym WordPress Theme [powerlift]
Researcher
Affected Software
Promo [promo]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Search & Go - Directory WordPress Theme [search-and-go]
Researcher
Affected Software
The Aisle - Elegant Wedding WordPress Theme [theaisle]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Antideo Email Validator [antideo-email-validator]
Researcher
Affected Software
CleverReach® WP [cleverreach-wp]
Researcher
Affected Software
Demo Importer Plus [demo-importer-plus]
Researcher
Affected Software
JNews - Pay Writer [jnews-pay-writer]
Researcher
Affected Software
Jupiter X Core [jupiterx-core]
Researcher
Affected Software
Kids Heaven - Children Education WordPress Theme [kids-world]
Researcher
Affected Software
Researcher
Affected Software
Laurent Core [laurent-core]
Researcher
Affected Software
Researcher
Affected Software
North - One Page Parallax WordPress Theme [north-wp]
Researcher
Affected Software
OneLife - Medical WordPress Theme [onelife]
Researcher
Affected Software
Post Slides [post-slides]
Researcher
Affected Software
Sales Countdown Timer for WooCommerce and WordPress [sctv-sales-countdown-timer]
Researcher
Affected Software
Shipping Rate By Cities [shipping-rate-by-cities]
Researcher
Affected Software
Simply Schedule Appointments [simply-schedule-appointments]
Researcher
Affected Software
Tutor LMS Pro [tutor-pro]
Researcher
Affected Software
Researcher
Affected Software
AJS Footnotes [ajs-footnotes]
Researcher
Affected Software
Geeky Bot – AI Sales Assistant for WooCommerce [geeky-bot]
Researcher
Affected Software
GetContentFromURL [getcontentfromurl]
Researcher
Affected Software
Infility Global [infility-global]
Researcher
Affected Software
Name Directory [name-directory]
Researcher
Affected Software
Researcher
Affected Software
Synergy Project Manager [synergy-project-manager]
Researcher
Affected Software
DASHBOARD BUILDER – WordPress plugin for Charts and Graphs [dashboard-builder]
Researcher
Affected Software
Awesome Support – WordPress HelpDesk & Support Plugin [awesome-support]
Researcher
Affected Software
Client Portal – Private user pages and login [client-portal]
Researcher
Affected Software
DZS Video Gallery [dzs-videogallery]
Researcher
Event Espresso 4 Decaf <= 5.0.37.decaf - Missing Authorization to Unauthenticated Settings Change
6.5
Affected Software
Event Espresso – Event Registration & Ticketing Sales [event-espresso-decaf]
Researcher
Affected Software
Researcher
Affected Software
Gotham Block Extra Light [gotham-block-extra-light]
Researcher
Affected Software
Thim Blocks [thim-blocks]
Researcher
Affected Software
WP Lead Capturing Pages [wp-lead-capture]
Researcher
Affected Software
Researcher
Affected Software
Woocommerce Book Price [woo-book-price]
Researcher
Affected Software
WooCommerce Frontend Manager – Ultimate [wc-frontend-manager-ultimate]
Researcher
Affected Software
XStore [xstore]
Researcher
Affected Software
Researcher
Affected Software
Avada (Fusion) Builder [fusion-builder]
Researcher
Affected Software
Best-wp-google-map [best-wp-google-map]
Researcher
Affected Software
CM Business Directory – Optimise and showcase local business [cm-business-directory]
Researcher
Affected Software
CubeWP Framework [cubewp-framework]
Researcher
Affected Software
Flex QR Code Generator [flex-qr-code-generator]
Researcher
Houzez Theme - Functionality <= 4.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
Houzez Theme - Functionality [houzez-theme-functionality]
Researcher
Affected Software
LearnPress – Course Review [learnpress-course-review]
Researcher
Affected Software
Penci Pay Writer [penci-pay-writer]
Researcher
Affected Software
Penci Review [penci-review]
Researcher
Affected Software
Related Posts by Taxonomy [related-posts-by-taxonomy]
Researcher
Affected Software
SearchWiz [searchwiz]
Affected Software
SpiceForms Form Builder [spiceforms-form-builder]
Researcher
Affected Software
Researcher
Affected Software
Turn Yoast SEO FAQ Block to Accordion [faq-schema-block-to-accordion]
Researcher
Affected Software
Researcher
Affected Software
User Submitted Posts – Enable Users to Submit Posts from the Front End [user-submitted-posts]
Researcher
Affected Software
Wpresidence Core [wpresidence-core]
Researcher
Affected Software
XStore [xstore]
Researcher
Affected Software
Accordion Slider PRO [accordion_slider_pro]
Researcher
Affected Software
Researcher
Affected Software
Auto Repair [auto-repair]
Researcher
Affected Software
bidorbuy Store Integrator [bidorbuystoreintegrator]
Researcher
Affected Software
Brookside [brookside]
Researcher
Affected Software
Researcher
Affected Software
Eli's WordCents adSense Widget with Analytics [wordcents]
Researcher
Affected Software
Hide My WP - Amazing Security Plugin for WordPress! [hide_my_wp]
Researcher
Affected Software
JNews - Frontend Submit [jnews-frontend-submit]
Researcher
Affected Software
JNews - Video [jnews-video]
Researcher
Affected Software
Researcher
Affected Software
List Site Contributors [list-site-contributors]
Researcher
Affected Software
Quote Master [quote-master]
Researcher
Affected Software
WP RSS Aggregator – RSS Import, Feed to Post, Autoblogging, AI Content [wp-rss-aggregator]
Researcher
Affected Software
WP Simple Redirect [wp-simple-redirect]
Researcher
Affected Software
Skillate [skillate]
Researcher
Affected Software
Syntax Highlighter Compress [syntax-highlighter-compress]
Researcher
Affected Software
WP Test Email [wp-test-email]
Researcher
Affected Software
Researcher
Affected Software
xPromoter [top_bar_promoter]
Researcher
Affected Software
Researcher
Affected Software
YouTube Feed Pro [youtube-feed-pro]
Researcher
Affected Software
Quick Contact Form [quick-contact-form]
Researcher
Affected Software
Seriously Simple Podcasting [seriously-simple-podcasting]
Researcher
Affected Software
WP Duplicate Page [wp-duplicate-page]
Researcher
Affected Software
WP-CRM System – Manage Clients and Projects [wp-crm-system]
Researcher
Affected Software
WP-Members Membership Plugin [wp-members]
Researcher
Affected Software
Alma – Pay in installments or later for WooCommerce [alma-gateway-for-woocommerce]
Researcher
Aplazo Payment Gateway <= 1.4.3 - Missing Authorization to Unauthenticated Order Status Manipulation
5.3
Affected Software
Aplazo Payment Gateway [aplazo-payment-gateway]
Researcher
Affected Software
AWP Classifieds [another-wordpress-classifieds-plugin]
Researcher
Affected Software
Bayarcash WooCommerce [bayarcash-wc]
Researcher
Affected Software
Breeze Cache [breeze]
Researcher
Affected Software
Cargus [cargus]
Researcher
Affected Software
Community Events [community-events]
Researcher
Cost Calculator Builder <= 3.6.9 - Missing Authorization to Unauthenticated Payment Status Bypass
5.3
Affected Software
Cost Calculator Builder [cost-calculator-builder]
Researcher
CubeWP – All-in-One Dynamic Content Framework <= 1.1.27 - Unauthenticated Information Exposure
5.3
Affected Software
CubeWP Framework [cubewp-framework]
Researcher
Affected Software
Ecwid by Lightspeed Ecommerce Shopping Cart [ecwid-shopping-cart]
Researcher
Affected Software
Essential Addons for Elementor – Popular Elementor Templates & Widgets [essential-addons-for-elementor-lite]
Researcher
Affected Software
EventPrime – Events Calendar, Bookings and Tickets [eventprime-event-calendar-management]
Researcher
Float Payment Gateway <= 1.1.9 - Improper Authorization to Unauthenticated Order Status Manipulation
5.3
Affected Software
Float Payment Gateway [float-gateway]
Researcher
Affected Software
Frontend File Manager Plugin [nmedia-user-file-uploader]
Researcher
Affected Software
Researcher
LottieFiles – Lottie block for Gutenberg <= 3.0.0 - Unauthenticated Sensitive Information Exposure
5.3
Affected Software
LottieFiles [lottiefiles]
Researcher
Affected Software
Netcash WooCommerce Payment Gateway [netcash-pay-now-payment-gateway-for-woocommerce]
Researcher
Affected Software
NextMove Lite – Thank You Page for WooCommerce [woo-thank-you-page-nextmove-lite]
Researcher
Affected Software
Researcher
Affected Software
onepay Payment Gateway For WooCommerce [onepay-payment-gateway-for-woocommerce]
Researcher
Affected Software
Orchid Store [orchid-store]
Researcher
Affected Software
PAYGENT for WooCommerce [woocommerce-for-paygent-payment-main]
Affected Software
PayHere Payment Gateway [payhere-payment-gateway]
Researcher
Affected Software
Payment Button for PayPal [wp-paypal]
Researcher
Affected Software
PDF Resume Parser [pdf-resume-parser]
Researcher
Affected Software
Peach Payments Gateway [wc-peach-payments-gateway]
Researcher
Affected Software
Perfit WooCommerce [perfit-woocommerce]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Reservation Plugin [dt-reservation-plugin]
Researcher
Affected Software
Shown Connector [shown-connector]
Researcher
Affected Software
Simple GDPR Cookie Compliance [simple-gdpr-cookie-compliance]
Researcher
Affected Software
Spectra Legacy – Gutenberg Blocks [ultimate-addons-for-gutenberg]
Researcher
Spin Wheel <= 2.1.0 - Unauthenticated Client-Side Prize Manipulation via 'prize_index' Parameter
5.3
Affected Software
Researcher
Affected Software
Travel Monster [travel-monster]
Researcher
Affected Software
Universal Google Adsense and Ads manager [universal-google-adsense-and-ads-manager]
Researcher
User Registration Using Contact Form 7 <= 2.5 - Authenticated (Subscriber+) Information Exposure
5.3
Affected Software
User Registration Using Contact Form 7 [user-registration-using-contact-form-7]
Researcher
Affected Software
WDV One Page Docs – Documentation Plugin for WordPress [wdv-one-page-docs]
Researcher
Affected Software
Wheel of Life: Coaching and Assessment Tool for Life Coach [wheel-of-life]
Researcher
WP Hotel Booking <= 2.2.7 - Unauthenticated Sensitive Information Exposure via 'email' Parameter
5.3
Affected Software
WP Hotel Booking [wp-hotel-booking]
Researcher
DK PDF – WordPress PDF Generator <= 2.3.0 - Authenticated (Author+) Server-Side Request Forgery
5.0
Affected Software
DK PDF – WordPress PDF Generator [dk-pdf]
Affected Software
Advanced Ads – Ad Manager & AdSense [advanced-ads]
Researcher
Affected Software
Shipping Rates by City for WooCommerce [flat-shipping-rate-by-city-for-woocommerce]
Researcher
Affected Software
CM E-Mail Blacklist – Simple email filtering for safer registration [cm-email-blacklist]
Researcher
Affected Software
Electric Studio Download Counter [electric-studio-download-counter]
Researcher
Affected Software
Filr – Secure document library [filr-protection]
Researcher
Affected Software
Gotham Block Extra Light [gotham-block-extra-light]
Researcher
Affected Software
Integrate Dynamics 365 CRM [integrate-dynamics-365-crm]
Researcher
Affected Software
Internal Link Builder [internal-link-builder]
Researcher
LinkedIn SC <= 1.1.9 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings Page
4.4
Affected Software
LinkedIn SC [linkedin-sc]
Researcher
Affected Software
WPBakery Page Builder Addons by Livemesh [addons-for-visual-composer]
Researcher
Affected Software
Real Post Slider Lite [real-post-slider-lite]
Researcher
Affected Software
Short Link [short-link]
Researcher
Affected Software
Testimonials Creator [testimonials-creator]
Researcher
Affected Software
WMF Mobile Redirector [wmf-mobile-redirector]
Researcher
Affected Software
WP Allowed Hosts [wp-allow-hosts]
Researcher
Affected Software
AJAX Hits Counter + Popular Posts Widget [ajax-hits-counter]
Researcher
Affected Software
Researcher
Affected Software
Booking Calendar [booking]
Researcher
Affected Software
CP Image Store with Slideshow [cp-image-store]
Researcher
Affected Software
Researcher
Affected Software
Dreamer Blog [dreamer-blog]
Researcher
Affected Software
electron [electron]
Researcher
Affected Software
Element Invader – Template Kits for Elementor [elementinvader]
Researcher
Affected Software
Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons [bdthemes-element-pack-lite]
Researcher
Affected Software
Researcher
Affected Software
Hyyan WooCommerce Polylang Integration [woo-poly-integration]
Researcher
LEAV Last Email Address Validator <= 1.7.1 - Cross-Site Request Forgery to Plugin Settings Update
4.3
Affected Software
LEAV Last Email Address Validator [last-email-address-validator]
Researcher
Affected Software
Researcher
Affected Software
Ninja Tables – Easy Data Table Builder [ninja-tables]
Researcher
Affected Software
Phrase TMS Integration for WordPress [memsource-connector]
Researcher
Affected Software
Premium Addons for Elementor – Elementor Templates, Widgets & MCP Tools [premium-addons-for-elementor]
Researcher
Affected Software
RealPress – Real Estate Plugin [realpress]
Researcher
Affected Software
Related Posts Thumbnails Plugin for WordPress [related-posts-thumbnails]
Researcher
Affected Software
RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress [computer-repair-shop]
Researcher
Affected Software
Responsive Accordion Slider [responsive-accordion-slider]
Researcher
Affected Software
Responsive Addons for Elementor – Free Elementor Addons, Kits and Elementor Templates [responsive-addons-for-elementor]
Researcher
Affected Software
Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning [wp-simple-firewall]
Researcher
Affected Software
Smart Product Viewer [smart-product-viewer]
Researcher
Affected Software
sober [sober]
Researcher
Affected Software
Auto Post to Social Media from Social Champ [auto-post-to-social-media-wp-to-social-champ]
Researcher
Affected Software
Solace [solace]
Researcher
Affected Software
Sosh Share Buttons [sosh-share-buttons]
Researcher
Affected Software
Stopwords for comments [stopwords-for-comments]
Researcher
Affected Software
The Guardian News Feed [the-guardian-news-feed]
Researcher
Affected Software
Tickera – Sell Tickets & Manage Events [tickera-event-ticketing-system]
Researcher
Affected Software
Visual Link Preview [visual-link-preview]
Researcher
Affected Software
WPBlogSyn [wpblogsync]
Researcher
Affected Software
WPMasterToolKit (WPMTK) – All in one plugin [wpmastertoolkit]
Researcher
Affected Software
Researcher
Affected Software
X Addons for Elementor – 20+ Widgets, Templates & Header Footer Builder [x-addons-elementor]
Researcher
Affected Software
Researcher
Affected Software
Zoho CRM Lead Magnet [zoho-crm-forms]
Researcher
Affected Software
Drag and Drop Multiple File Upload for Contact Form 7 [drag-and-drop-multiple-file-upload-contact-form-7]
Researcher
Affected Software
Church Admin [church-admin]
Researcher
As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.
This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
Comments