Wordfence Intelligence Weekly WordPress Vulnerability Report (February 16, 2026 to February 22, 2026)
Last week, there were 276 vulnerabilities disclosed in 193 WordPress Plugins and 57 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 103 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.
Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back.
Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 33,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
New Firewall Rules Deployed Last Week
The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.
The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:
-
-
- WAF-RULE-895 – Data redacted while we work with the vendor on a patch.
-
Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.
Total Unpatched & Patched Vulnerabilities Last Week
| Patch Status | Number of Vulnerabilities |
|---|---|
| Patched | 208 |
| Unpatched | 68 |
Total Vulnerabilities by CVSS Severity Last Week
| Severity Rating | Number of Vulnerabilities |
|---|---|
| Low Severity | 4 |
| Medium Severity | 195 |
| High Severity | 69 |
| Critical Severity | 8 |
Total Vulnerabilities by CWE Type Last Week
| Vulnerability Type by CWE | Number of Vulnerabilities |
|---|---|
| Missing Authorization | 99 |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 55 |
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | 35 |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 16 |
| Cross-Site Request Forgery (CSRF) | 11 |
| Exposure of Sensitive Information to an Unauthorized Actor | 8 |
| Deserialization of Untrusted Data | 7 |
| Improper Privilege Management | 7 |
| Authorization Bypass Through User-Controlled Key | 5 |
| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 4 |
| Server-Side Request Forgery (SSRF) | 4 |
| Unrestricted Upload of File with Dangerous Type | 4 |
| Improper Access Control | 2 |
| Improper Control of Generation of Code ('Code Injection') | 2 |
| Incorrect Authorization | 2 |
| Insufficient Verification of Data Authenticity | 2 |
| URL Redirection to Untrusted Site ('Open Redirect') | 2 |
| Access of Resource Using Incompatible Type ('Type Confusion') | 1 |
| Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') | 1 |
| External Control of System or Configuration Setting | 1 |
| Improper Authorization | 1 |
| Improper Handling of Missing Values | 1 |
| Improper Input Validation | 1 |
| Improper Neutralization of CRLF Sequences ('CRLF Injection') | 1 |
| Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | 1 |
| Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | 1 |
| Missing Authentication for Critical Function | 1 |
| Use of Predictable Algorithm in Random Number Generator | 1 |
Researchers That Contributed to WordPress Security Last Week
| Researcher Name | Number of Vulnerabilities |
|---|---|
| 23 | |
| 19 | |
| 15 | |
| 14 | |
| 14 | |
| 11 | |
| 11 | |
| 7 | |
| 7 | |
| 6 | |
| 6 | |
| 5 | |
| 5 | |
| 5 | |
| 4 | |
| 4 | |
| 4 | |
| 4 | |
| 4 | |
| 4 | |
| 4 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.
WordPress Plugins with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| Academy LMS | academy |
| ACF Photo Gallery Field | navz-photo-gallery |
| Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager | ap-plugin-scripteo |
| Advance Block Extend | advance-block-extend |
| Advanced Ads – Ad Manager & AdSense | advanced-ads |
| Advanced AJAX Product Filters | woocommerce-ajax-filters |
| Advanced Custom Fields: Font Awesome Field | advanced-custom-fields-font-awesome |
| Album and Image Gallery Plus Lightbox | album-and-image-gallery-plus-lightbox |
| Apollo13 Framework Extensions | apollo13-framework-extensions |
| Applay - Shortcodes | applay-shortcodes |
| Appointment Booking Plugin for WooCommerce | Online Booking Calendar & Service Manager | service-booking-manager |
| Aruba HiSpeed Cache | aruba-hispeed-cache |
| BackWPup – WordPress Backup & Restore Plugin | backwpup |
| Banner Management For WooCommerce | banner-management-for-woocommerce |
| Blog2Social: Social Media Auto Post & Scheduler | blog2social |
| Book Previewer for Woocommerce | book-previewer-for-woocommerce |
| Booking Calendar | booking |
| Bookster – WordPress Appointment Booking Plugin | bookster |
| Breadcrumb NavXT | breadcrumb-navxt |
| Breeze Cache | breeze |
| Brevo – Email, SMS, Web Push, Chat, and more. | mailin |
| Brizy – Page Builder | brizy |
| Broadstreet | broadstreet |
| BSK PDF Manager | bsk-pdf-manager |
| Business Directory Plugin – Easy Listing Directories for WordPress | business-directory-plugin |
| Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More | calculated-fields-form |
| Cart All In One For WooCommerce | woo-cart-all-in-one |
| Checkout Field Manager (Checkout Manager) for WooCommerce | woocommerce-checkout-manager |
| Checkout for PayPal | checkout-for-paypal |
| Clasifico Listing | clasifico-listing |
| Client Testimonial Slider | wp-client-testimonial |
| Collapsing Archives | collapsing-archives |
| Collapsing Categories | collapsing-categories |
| Community Events | community-events |
| Complianz – GDPR/CCPA Cookie Consent | complianz-gdpr |
| Cookie Banner for GDPR / CCPA – WPLP Cookie Consent | gdpr-cookie-consent |
| Country Blocker for AdSense | country-blocker-for-adsense |
| Court Reservation – Manage Your Court Bookings Online | court-reservation |
| Dam Spam | dam-spam |
| Dealia – Request a quote | dealia-request-a-quote |
| Diet Calorie Calculator | diet-calorie-calculator |
| Directorist: AI-Powered Business Directory, Listings & Classified Ads | directorist |
| Display During Conditional Shortcode | display-during-conditional-shortcode |
| Display Eventbrite Events | widget-for-eventbrite-api |
| Download Manager | download-manager |
| Easy Author Image | easy-author-image |
| Easy SVG Support | easy-svg |
| Easy Table of Contents | easy-table-of-contents |
| EmailKit – Email Customizer for WooCommerce & WP | emailkit |
| Envo Extra | envo-extra |
| Event Booking Manager for WooCommerce – Registration, RSVP, Calendar & Tickets | mage-eventpress |
| EventPrime – Events Calendar, Bookings and Tickets | eventprime-event-calendar-management |
| Extra Fees for WooCommerce | woo-conditional-product-fees-for-checkout |
| Filestack | filepicker-media-uploader |
| Forminator Forms – Contact Form, Payment Form & Custom Form Builder | forminator |
| Frontend File Manager Plugin | nmedia-user-file-uploader |
| Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin | frontend-post-submission-manager-lite |
| Frontend User Notes | frontend-user-notes |
| Garden Gnome Package | garden-gnome-package |
| GEO Plugin by Squirrly SEO | squirrly-seo |
| Geo to Lat | geo-to-lat |
| Greenly Theme Addons | greenly-addons |
| Groups | groups |
| Hello Bar Popup Builder | hellobar |
| IDonate – Blood Donation, Request And Donor Management System | idonate |
| Image Hotspot by DevVN | devvn-image-hotspot |
| Image Optimization – Compress Images and Convert to WebP or AVIF | image-optimization |
| Image Photo Gallery Final Tiles Grid | final-tiles-grid-gallery-lite |
| Image Slider by Ays- Responsive Slider and Carousel | ays-slider |
| Institute Management – Learning Management System | institute-management |
| InteractiveCalculator for WordPress | interactivecalculator |
| iXML – Google XML sitemap generator | ixml |
| iZooto – Web Push Notifications | izooto-web-push |
| Jetpack CRM – Clients, Leads, Invoices, Billing, Email Marketing, & Automation | zero-bs-crm |
| Kadence Blocks — Page Builder Toolkit for Gutenberg Editor | kadence-blocks |
| Kali Forms — Contact Form & Drag-and-Drop Builder | kali-forms |
| Keybase.io Verification | wp-keybase-verification |
| Korea SNS | korea-sns |
| leadlovers forms | leadlovers-forms |
| Leadrebel | leadrebel |
| Library Management System | library-management-system |
| Link Whisper Free | link-whisper |
| linkPizza-Manager | linkpizza-manager |
| Lizza LMS Pro | lizza-lms-pro |
| Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails | mail-mint |
| Mailchimp List Subscribe Form | mailchimp |
| Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits | master-addons |
| Media Library Assistant | media-library-assistant |
| Medilink-Core | medilink-core |
| Membership Plugin – Kadence Memberships | restrict-content |
| Mesmerize Companion | mesmerize-companion |
| MK Google Directions | google-distance-calculator |
| Modal Dialog | modal-dialog |
| MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar | mp3-music-player-by-sonaar |
| Nelio A/B Testing – AB Tests and Heatmaps for Better Conversion Optimization | nelio-ab-testing |
| News Element Elementor Blog Magazine | news-element |
| NitroPack – Performance, Page Speed & Cache Plugin for Core Web Vitals, CDN & Image Optimization | nitropack |
| NM Gift Registry and Wishlist Lite | nm-gift-registry-and-wishlist-lite |
| OneClick Chat to Order | oneclick-whatsapp-order |
| Open User Map – Interactive Leaflet Maps | open-user-map |
| Order Splitter for WooCommerce | woo-order-splitter |
| Orderable – Restaurant & Food Ordering System | orderable |
| Page Title, Description & Open Graph Updater | page-title-description-open-graph-updater |
| Panda Pods Repeater Field | panda-pods-repeater-field |
| PDF Invoices & Packing Slips for WooCommerce | woocommerce-pdf-invoices-packing-slips |
| Pinpoint Booking System – Version 2 | booking-system |
| Popup Box – Easily Create WordPress Popups | popup-box |
| Popup Builder – Create highly converting, mobile friendly marketing popups. | popup-builder |
| PostmarkApp Email Integrator | postmarkapp-email-integrator |
| Printful Integration for WooCommerce | printful-shipping-for-woocommerce |
| Private Comment | private-comment |
| Prodigy Commerce | prodigy-commerce |
| Product Addons for Woocommerce – Product Options with Custom Fields | woo-custom-product-addons |
| Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels | webappick-product-feed-for-woocommerce |
| Product Price by Formula for WooCommerce | product-price-by-formula-for-woocommerce |
| Product Table & List Builder For WooCommerce | wc-product-table-lite |
| PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus | capability-manager-enhanced |
| Quiz Maker by AYS | quiz-maker |
| Razorpay for WooCommerce | woo-razorpay |
| RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login | custom-registration-form-builder-with-submission-manager |
| Remove Post Type Slug | remove-post-type-slug |
| Rent Fetch | rentfetch |
| s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions | s2member |
| salavat counter Plugin | salavat-counter |
| SEO Friendly Images | seo-image |
| Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning | wp-simple-firewall |
| ShipTime: Discounted Shipping Rates | shiptime-discount-shipping |
| ShopBuilder – WooCommerce Builder For Elementor | shopbuilder |
| ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin | woolentor-addons |
| Simple Ajax Chat – Add a Fast, Secure Chat Box | simple-ajax-chat |
| Simple Membership | simple-membership |
| SiteOrigin Widgets Bundle | so-widgets-bundle |
| Slider Future | slider-future |
| Slidorion | slidorion |
| Smartsupp – live chat, AI shopping assistant and chatbots | smartsupp-live-chat |
| SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery | sms-alert |
| Sprout Invoices – Client Invoicing & Estimates | sprout-invoices |
| StatCounter – Free Real Time Visitor Stats | official-statcounter-plugin-for-wordpress |
| Studio99 WP Monitor | studio99-wp-monitor |
| Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent | tablesome |
| TalkJS | talkjs |
| Taskbuilder – Project Management & Task Management Tool With Kanban Board | taskbuilder |
| Team – Team Members Showcase Plugin | tlp-team |
| Tennis Court Bookings | tennis-court-bookings |
| The Moneytizer | the-moneytizer |
| The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce | the-plus-addons-for-elementor-page-builder |
| Tickera – Sell Tickets & Manage Events | tickera-event-ticketing-system |
| Toocheke Companion | toocheke-companion |
| Toret Manager | toret-manager |
| TrueBooker – Appointment Booking and Scheduler System | truebooker-appointment-booking |
| Turbo Manager | turbo-manager |
| Two Factor (2FA) Authentication via Email | two-factor-2fa-via-email |
| Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin | ultimate-member |
| URL Shortify – Simple and Easy URL Shortener | url-shortify |
| User Submitted Posts – Enable Users to Submit Posts from the Front End | user-submitted-posts |
| UserFeedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds | userfeedback-lite |
| Video Conferencing with Zoom | video-conferencing-with-zoom-api |
| Video Share VOD – Turnkey Video Site Builder Script | video-share-vod |
| Virusdie | One-click website security | virusdie |
| Visual Link Preview | visual-link-preview |
| VK All in One Expansion Unit | vk-all-in-one-expansion-unit |
| Wallet for WooCommerce | woo-wallet |
| Web Accessibility (formally known as Ally) – WCAG Scanning, Guided Fixes, Usability Widget | pojo-accessibility |
| Web Accessibility by accessiBe | accessibe |
| weMail – Email Marketing, Newsletter Builder & Email Automations for WooCommerce | wemail |
| Whatsiplus Scheduled Notification for Woocommerce | whatsiplus-scheduled-notification-for-woocommerce |
| Wholesale Lead Capture Plugin for WooCommerce | woocommerce-wholesale-lead-capture |
| Wholesale Suite – B2B, Dynamic Pricing & WooCommerce Wholesale Prices | woocommerce-wholesale-prices |
| Wolmart Core | wolmart-core |
| WowRevenue – Product Bundles & Bulk Discounts | revenue |
| WP 404 Auto Redirect to Similar Post | wp-404-auto-redirect-to-similar-post |
| WP All Export – Drag & Drop Export to Any Custom CSV, XML & Excel | wp-all-export |
| WP AUDIO GALLERY | wp-audio-gallery |
| WP Compress – Instant Performance & Speed Optimization | wp-compress-image-optimizer |
| WP Customer Reviews | wp-customer-reviews |
| WP Event Aggregator: Import Eventbrite events, Meetup events, social events and any iCal Events into Event Calendar | wp-event-aggregator |
| WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters | wp-google-map-plugin |
| WP Plugin Info Card | wp-plugin-info-card |
| WP RSS Aggregator – RSS Import, Feed to Post, Autoblogging, AI Content | wp-rss-aggregator |
| WP Ultimate CSV Importer – WordPress Import & Export for CSV, XML & Excel | wp-ultimate-csv-importer |
| WP-DownloadManager | wp-downloadmanager |
| WP-Lister Lite for eBay | wp-lister-for-ebay |
| WPC Product Bundles for WooCommerce | woo-product-bundle |
| WPC Smart Wishlist for WooCommerce | woo-smart-wishlist |
| wpForo Forum | wpforo |
| WPNakama – Team and multi-Client Collaboration, Editorial and Project Management | wpnakama |
| xmlrpc attacks blocker | xmlrpc-attacks-blocker |
| XO Event Calendar | xo-event-calendar |
| Xpro Addons For Beaver Builder – Lite | xpro-addons-beaver-builder-elementor |
| YaMaps for WordPress Plugin | yamaps |
| YayMail – WooCommerce Email Customizer | yaymail |
| YMC Filter | ymc-smart-filter |
| افزونه پرداخت امن زرینپال برای ووکامرس (ZarinPal for WooCommerce) | zarinpal-woocommerce-payment-gateway |
WordPress Themes with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| A-Mart - Organic Products Store Shopify Theme | a-mart |
| App Landing Page | app-landing-page |
| Blabber | Elementor Blog & News Magazine Theme | blabber |
| Boldman - Handyman Renovation Services WordPress Theme + RTL | boldman |
| Book Landing Page | book-landing-page |
| Buyent | buyent |
| Context Blog | context-blog |
| Coworking - Open Office & Creative Space WordPress Theme | coworking |
| Digital Download | digital-download |
| Drift | drift |
| Elegant Pink | elegant-pink |
| Emphires - Human Resources & Recruiting Theme | emphires |
| Fooddy 24/7 - Food Delivery Takeout WordPress Theme + Elementor + RTL | fooddy |
| Freeio - Freelance Marketplace WordPress Theme | freeio |
| glb | glb |
| Grand Restaurant WordPress | grandrestaurant |
| Greenly - Ecology & Solar Energy WordPress Theme | greenly |
| Gustavo | Mexican Grill, Bar & Restaurant WordPress Theme | gustavo |
| Homeo - Real Estate WordPress Theme | homeo |
| Impacto Patronus | Nature Protection, Petitions & Social Activism WordPress Theme + RTL | impacto-patronus |
| Influencer | influencer |
| Ippsum - Business Consulting WordPress Theme | ippsum |
| Ironfit - Fitness, Gym and Crossfit WordPress Theme | ironfit |
| Isida - Plastic Surgery Clinic Medical WordPress Theme | isida |
| Jude | Nail Bar & Beauty Salon WordPress Theme | jude |
| Kalon | kalon |
| LabtechCO | Laboratory & Science Research WordPress Theme | labtechco |
| Marveland - Theme Park & Festival WordPress Theme | marveland |
| Mega Store Woocommerce | mega-store-woocommerce |
| Nanosoft - WP Theme for IT Solutions and Services Company | nanosoft |
| Netmix | Broadband & Telecom Internet Provider WordPress Theme | netmix |
| NewsBlogger | newsblogger |
| Numinous | numinous |
| Organic Food - Farm & Food Business Eco WordPress | organicfood |
| Parkivia | Auto Parking & Car Maintenance WordPress Theme | parkivia |
| PawFriends - Pet Shop and Veterinary WordPress Theme | pawfriends |
| Photolia | Photo Company & Supply Store WordPress Theme | photolia |
| Pranayama Yoga | pranayama-yoga |
| Rara Academic | rara-academic |
| redy | redy |
| Renden | renden |
| Rhodos - Business Portfolio Elementor Blocks & Template Kit | rhodos |
| Ridhi | ridhi |
| Saveo | In-home Care & Private Nursing Agency WordPress Theme | saveo |
| SevenTrees | Real Estate Property WordPress Theme | seventrees |
| Shopire | shopire |
| smartfix | smartfix |
| Soleng | Solar Energy WordPress Theme | soleng |
| Spa and Salon | spa-and-salon |
| Support for CitiLights - Real Estate WordPress Theme | noo-citilights |
| The Minimal | the-minimal |
| Travel Diaries | travel-diaries |
| UnlimHost - Web Hosting & Internet Technology WordPress Theme | unlimhost |
| Valenti | valenti |
| Wiguard – CCTV & Security WordPress Theme for Surveillance Companies | wiguard |
| Woodmart | woodmart |
| Zio Alberto – Restaurant – Cafe – Bistro Theme | zioalberto |
Vulnerability Details
Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.
Affected Software
Clasifico Listing [clasifico-listing]
Researcher
Affected Software
Lizza LMS Pro [lizza-lms-pro]
Researcher
Affected Software
Prodigy Commerce [prodigy-commerce]
Affected Software
Researcher
Affected Software
Slider Future [slider-future]
Researcher
Affected Software
Wholesale Lead Capture Plugin for WooCommerce [woocommerce-wholesale-lead-capture]
Researcher
Affected Software
Wholesale Lead Capture Plugin for WooCommerce [woocommerce-wholesale-lead-capture]
Researcher
Affected Software
Advanced AJAX Product Filters [woocommerce-ajax-filters]
Affected Software
Researcher
Affected Software
NewsBlogger [newsblogger]
Researcher
Affected Software
Orderable – Restaurant & Food Ordering System [orderable]
Researcher
Affected Software
Researcher
Affected Software
Toret Manager [toret-manager]
Researcher
Affected Software
Researcher
Affected Software
Researcher
WP AUDIO GALLERY <= 2.0 - Authenticated (Subscriber+) Arbitrary File Read via .htaccess Manipulation
8.8
Affected Software
WP AUDIO GALLERY [wp-audio-gallery]
Researcher
Affected Software
WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters [wp-google-map-plugin]
Researcher
Affected Software
ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin [woolentor-addons]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Grand Restaurant WordPress [grandrestaurant]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
PawFriends - Pet Shop and Veterinary WordPress Theme [pawfriends]
Researcher
Affected Software
Researcher
Affected Software
redy [redy]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
SevenTrees | Real Estate Property WordPress Theme [seventrees]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Zio Alberto – Restaurant – Cafe – Bistro Theme [zioalberto]
Researcher
Affected Software
افزونه پرداخت امن زرینپال برای ووکامرس (ZarinPal for WooCommerce) [zarinpal-woocommerce-payment-gateway]
Researcher
Affected Software
Applay - Shortcodes [applay-shortcodes]
Researcher
Affected Software
Researcher
Affected Software
Business Directory Plugin – Easy Listing Directories for WordPress [business-directory-plugin]
Researcher
Affected Software
Sprout Invoices – Client Invoicing & Estimates [sprout-invoices]
Researcher
Affected Software
Cookie Banner for GDPR / CCPA – WPLP Cookie Consent [gdpr-cookie-consent]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Greenly Theme Addons [greenly-addons]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Library Management System [library-management-system]
Affected Software
Medilink-Core [medilink-core]
Researcher
Affected Software
Organic Food - Farm & Food Business Eco WordPress [organicfood]
Researcher
Affected Software
Product Table & List Builder For WooCommerce [wc-product-table-lite]
Researcher
Affected Software
Turbo Manager [turbo-manager]
Researcher
Affected Software
Valenti [valenti]
Researcher
Affected Software
Wolmart Core [wolmart-core]
Researcher
Woocommerce Category Banner Management <= 2.5.1 - Authenticated (Contributor+) PHP Object Injection
7.5
Affected Software
Banner Management For WooCommerce [banner-management-for-woocommerce]
Researcher
Affected Software
Appointment Booking Plugin for WooCommerce | Online Booking Calendar & Service Manager [service-booking-manager]
Researcher
Affected Software
wpForo Forum [wpforo]
Researcher
Affected Software
Researcher
Affected Software
BackWPup – WordPress Backup & Restore Plugin [backwpup]
Researcher
Affected Software
Cart All In One For WooCommerce [woo-cart-all-in-one]
Researcher
Affected Software
Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels [webappick-product-feed-for-woocommerce]
Researcher
Affected Software
Modal Dialog [modal-dialog]
Researcher
Affected Software
Product Addons for Woocommerce – Product Options with Custom Fields [woo-custom-product-addons]
Researcher
Affected Software
Rent Fetch [rentfetch]
Affected Software
WP RSS Aggregator – RSS Import, Feed to Post, Autoblogging, AI Content [wp-rss-aggregator]
Researcher
Affected Software
Wholesale Suite – B2B, Dynamic Pricing & WooCommerce Wholesale Prices [woocommerce-wholesale-prices]
Researcher
Affected Software
WP Customer Reviews [wp-customer-reviews]
Affected Software
YayMail – WooCommerce Email Customizer [yaymail]
Researcher
Affected Software
Aruba HiSpeed Cache [aruba-hispeed-cache]
Researcher
Affected Software
Blog2Social: Social Media Auto Post & Scheduler [blog2social]
Researcher
Affected Software
Researcher
Affected Software
Collapsing Archives [collapsing-archives]
Researcher
Affected Software
Collapsing Categories [collapsing-categories]
Researcher
Affected Software
Geo to Lat [geo-to-lat]
Researcher
Affected Software
Media Library Assistant [media-library-assistant]
Researcher
Affected Software
Open User Map – Interactive Leaflet Maps [open-user-map]
Researcher
Affected Software
Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning [wp-simple-firewall]
Researcher
Affected Software
Simple Membership [simple-membership]
Researcher
Affected Software
Researcher
Affected Software
Two Factor (2FA) Authentication via Email [two-factor-2fa-via-email]
Researcher
Affected Software
Researcher
Affected Software
WP Ultimate CSV Importer – WordPress Import & Export for CSV, XML & Excel [wp-ultimate-csv-importer]
Researchers
Affected Software
WP-DownloadManager [wp-downloadmanager]
Researcher
Affected Software
Advance Block Extend [advance-block-extend]
Affected Software
Advanced Custom Fields: Font Awesome Field [advanced-custom-fields-font-awesome]
Researcher
Affected Software
Album and Image Gallery Plus Lightbox [album-and-image-gallery-plus-lightbox]
Researcher
Affected Software
Apollo13 Framework Extensions [apollo13-framework-extensions]
Researcher
Affected Software
Complianz – GDPR/CCPA Cookie Consent [complianz-gdpr]
Researcher
Affected Software
Dealia – Request a quote [dealia-request-a-quote]
Affected Software
Display During Conditional Shortcode [display-during-conditional-shortcode]
Researcher
Affected Software
Drift [drift]
Researcher
Affected Software
Easy Author Image [easy-author-image]
Researcher
Affected Software
Easy Table of Contents [easy-table-of-contents]
Researcher
Affected Software
Filestack [filepicker-media-uploader]
Researcher
Affected Software
Garden Gnome Package [garden-gnome-package]
Researcher
Affected Software
Groups [groups]
Researcher
Affected Software
Hello Bar Popup Builder [hellobar]
Researcher
Affected Software
Image Hotspot by DevVN [devvn-image-hotspot]
Researcher
Affected Software
InteractiveCalculator for WordPress [interactivecalculator]
Researcher
Affected Software
Korea SNS [korea-sns]
Researcher
Affected Software
Researcher
Affected Software
MK Google Directions [google-distance-calculator]
Researcher
Affected Software
StatCounter – Free Real Time Visitor Stats [official-statcounter-plugin-for-wordpress]
Researcher
Affected Software
Popup Box – Easily Create WordPress Popups [popup-box]
Researcher
Affected Software
Printful Integration for WooCommerce [printful-shipping-for-woocommerce]
Researcher
Affected Software
Quiz Maker by AYS [quiz-maker]
Researcher
Affected Software
Renden [renden]
Researcher
Affected Software
Researcher
Affected Software
SEO Friendly Images [seo-image]
Researcher
Affected Software
Smartsupp – live chat, AI shopping assistant and chatbots [smartsupp-live-chat]
Researcher
Affected Software
Toocheke Companion [toocheke-companion]
Researcher
Affected Software
URL Shortify – Simple and Easy URL Shortener [url-shortify]
Researcher
Affected Software
Visual Link Preview [visual-link-preview]
Researcher
Affected Software
VK All in One Expansion Unit [vk-all-in-one-expansion-unit]
Researcher
Affected Software
Researchers
Affected Software
XO Event Calendar [xo-event-calendar]
Researcher
Affected Software
YaMaps for WordPress Plugin [yamaps]
Researcher
Affected Software
Aruba HiSpeed Cache [aruba-hispeed-cache]
Researcher
Affected Software
Download Manager [download-manager]
Researcher
Affected Software
Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin [frontend-post-submission-manager-lite]
Researcher
Affected Software
Researcher
Affected Software
Link Whisper Free [link-whisper]
Researcher
Shield Security <= 21.0.8 - Unauthenticated Reflected Cross-Site Scripting via 'message' Parameter
6.1
Affected Software
Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning [wp-simple-firewall]
Researcher
Affected Software
Researcher
xmlrpc attacks blocker <= 1.0 - Unauthenticated Stored Cross-Site Scripting via 'X-Forwarded-For'
6.1
Affected Software
xmlrpc attacks blocker [xmlrpc-attacks-blocker]
Researcher
Affected Software
News Element Elementor Blog Magazine [news-element]
Researcher
Affected Software
SiteOrigin Widgets Bundle [so-widgets-bundle]
Researcher
Affected Software
Researcher
Affected Software
App Landing Page [app-landing-page]
Researcher
Affected Software
Aruba HiSpeed Cache [aruba-hispeed-cache]
Researcher
Affected Software
Book Landing Page [book-landing-page]
Researcher
Affected Software
Book Previewer for Woocommerce [book-previewer-for-woocommerce]
Researcher
Affected Software
Breadcrumb NavXT [breadcrumb-navxt]
Researcher
Affected Software
Breeze Cache [breeze]
Researcher
Affected Software
BSK PDF Manager [bsk-pdf-manager]
Researcher
Affected Software
Business Directory Plugin – Easy Listing Directories for WordPress [business-directory-plugin]
Researcher
Affected Software
Checkout Field Manager (Checkout Manager) for WooCommerce [woocommerce-checkout-manager]
Researcher
Affected Software
Checkout Field Manager (Checkout Manager) for WooCommerce [woocommerce-checkout-manager]
Researcher
Affected Software
Checkout for PayPal [checkout-for-paypal]
Researcher
Affected Software
Support for CitiLights - Real Estate WordPress Theme [noo-citilights]
Researcher
Affected Software
WP Compress – Instant Performance & Speed Optimization [wp-compress-image-optimizer]
Researcher
Affected Software
Context Blog [context-blog]
Researcher
Affected Software
Court Reservation – Manage Your Court Bookings Online [court-reservation]
Researcher
Affected Software
Diet Calorie Calculator [diet-calorie-calculator]
Researcher
Affected Software
Digital Download [digital-download]
Researcher
Affected Software
Researcher
Affected Software
Display Eventbrite Events [widget-for-eventbrite-api]
Researcher
Affected Software
Download Manager [download-manager]
Researcher
Affected Software
Elegant Pink [elegant-pink]
Researcher
Affected Software
EventPrime – Events Calendar, Bookings and Tickets [eventprime-event-calendar-management]
Researcher
Affected Software
EventPrime – Events Calendar, Bookings and Tickets [eventprime-event-calendar-management]
Researcher
Affected Software
YMC Filter [ymc-smart-filter]
Researcher
Affected Software
Researcher
Affected Software
Frontend File Manager Plugin [nmedia-user-file-uploader]
Researcher
Affected Software
Image Slider by Ays- Responsive Slider and Carousel [ays-slider]
Researcher
Affected Software
Influencer [influencer]
Researcher
Affected Software
iZooto – Web Push Notifications [izooto-web-push]
Researcher
Affected Software
Kalon [kalon]
Researcher
Affected Software
leadlovers forms [leadlovers-forms]
Researcher
Affected Software
Leadrebel [leadrebel]
Researcher
Affected Software
linkPizza-Manager [linkpizza-manager]
Researcher
Affected Software
Researcher
Affected Software
Mega Store Woocommerce [mega-store-woocommerce]
Researcher
Affected Software
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar [mp3-music-player-by-sonaar]
Researcher
Affected Software
Researcher
Affected Software
NM Gift Registry and Wishlist Lite [nm-gift-registry-and-wishlist-lite]
Researcher
Affected Software
Numinous [numinous]
Researcher
Affected Software
Panda Pods Repeater Field [panda-pods-repeater-field]
Researcher
Affected Software
Pinpoint Booking System – Version 2 [booking-system]
Researcher
Affected Software
Researcher
Affected Software
Pranayama Yoga [pranayama-yoga]
Researcher
Affected Software
Product Price by Formula for WooCommerce [product-price-by-formula-for-woocommerce]
Researcher
Affected Software
Rara Academic [rara-academic]
Researcher
Razorpay for WooCommerce <= 4.7.8 - Missing Authentication to Unauthenticated Order Modification
5.3
Affected Software
Razorpay for WooCommerce [woo-razorpay]
Researcher
Affected Software
Razorpay for WooCommerce [woo-razorpay]
Researcher
Affected Software
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login [custom-registration-form-builder-with-submission-manager]
Researcher
Affected Software
Ridhi [ridhi]
Researcher
Affected Software
ShipTime: Discounted Shipping Rates [shiptime-discount-shipping]
Researcher
ShopBuilder – Elementor WooCommerce Builder Addons <= 3.2.4 - Unauthenticated Information Exposure
5.3
Affected Software
ShopBuilder – WooCommerce Builder For Elementor [shopbuilder]
Researcher
Affected Software
Simple Ajax Chat – Add a Fast, Secure Chat Box [simple-ajax-chat]
Researcher
Affected Software
Spa and Salon [spa-and-salon]
Researcher
Affected Software
Studio99 WP Monitor [studio99-wp-monitor]
Researcher
Affected Software
Team – Team Members Showcase Plugin [tlp-team]
Researcher
Affected Software
The Minimal [the-minimal]
Researcher
Affected Software
The Moneytizer [the-moneytizer]
Researcher
Affected Software
The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce [the-plus-addons-for-elementor-page-builder]
Researcher
Affected Software
Travel Diaries [travel-diaries]
Researcher
Affected Software
TrueBooker – Appointment Booking and Scheduler System [truebooker-appointment-booking]
Researcher
Affected Software
User Submitted Posts – Enable Users to Submit Posts from the Front End [user-submitted-posts]
Researcher
Affected Software
Video Conferencing with Zoom [video-conferencing-with-zoom-api]
Researcher
Affected Software
Web Accessibility by accessiBe [accessibe]
Researcher
Affected Software
WP-Lister Lite for eBay [wp-lister-for-ebay]
Researcher
Affected Software
Xpro Addons For Beaver Builder – Lite [xpro-addons-beaver-builder-elementor]
Researcher
Affected Software
YayMail – WooCommerce Email Customizer [yaymail]
Researcher
Affected Software
Researcher
Affected Software
Nelio A/B Testing – AB Tests and Heatmaps for Better Conversion Optimization [nelio-ab-testing]
Researcher
Affected Software
Researcher
Affected Software
URL Shortify – Simple and Easy URL Shortener [url-shortify]
Researcher
Affected Software
Client Testimonial Slider [wp-client-testimonial]
Researcher
Affected Software
Community Events [community-events]
Researcher
Easy SVG Support <= 4.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
4.4
Affected Software
Easy SVG Support [easy-svg]
Researcher
Affected Software
Researcher
Affected Software
Institute Management – Learning Management System [institute-management]
Researcher
Affected Software
Membership Plugin – Kadence Memberships [restrict-content]
Researcher
Affected Software
PostmarkApp Email Integrator [postmarkapp-email-integrator]
Researcher
Affected Software
Private Comment [private-comment]
Researcher
Affected Software
salavat counter Plugin [salavat-counter]
Researcher
Affected Software
Tennis Court Bookings [tennis-court-bookings]
Researcher
Affected Software
Video Share VOD – Turnkey Video Site Builder Script [video-share-vod]
Researcher
Affected Software
WP 404 Auto Redirect to Similar Post [wp-404-auto-redirect-to-similar-post]
Researcher
YayMail <= 4.3.2 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via Template Elements
4.4
Affected Software
YayMail – WooCommerce Email Customizer [yaymail]
Researcher
Affected Software
Academy LMS [academy]
Researcher
Affected Software
ACF Photo Gallery Field [navz-photo-gallery]
Researcher
Affected Software
Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager [ap-plugin-scripteo]
Researcher
Affected Software
Advanced Ads – Ad Manager & AdSense [advanced-ads]
Researcher
Affected Software
Booking Calendar [booking]
Researcher
Affected Software
Brizy – Page Builder [brizy]
Researcher
Affected Software
Broadstreet [broadstreet]
Researcher
Affected Software
Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More [calculated-fields-form]
Researcher
Affected Software
Country Blocker for AdSense [country-blocker-for-adsense]
Researcher
Affected Software
Court Reservation – Manage Your Court Bookings Online [court-reservation]
Researcher
Affected Software
Dam Spam [dam-spam]
Researcher
Affected Software
Dealia – Request a quote [dealia-request-a-quote]
Affected Software
Researcher
Affected Software
Envo Extra [envo-extra]
Researcher
Affected Software
EventPrime – Events Calendar, Bookings and Tickets [eventprime-event-calendar-management]
Researcher
Affected Software
Extra Fees for WooCommerce [woo-conditional-product-fees-for-checkout]
Researcher
Affected Software
Frontend User Notes [frontend-user-notes]
Researcher
Affected Software
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks]
Researcher
Affected Software
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks]
Researcher
Affected Software
Image Optimization – Compress Images and Convert to WebP or AVIF [image-optimization]
Researcher
Affected Software
Image Photo Gallery Final Tiles Grid [final-tiles-grid-gallery-lite]
Researcher
Affected Software
Kali Forms — Contact Form & Drag-and-Drop Builder [kali-forms]
Researcher
Affected Software
Keybase.io Verification [wp-keybase-verification]
Researcher
Affected Software
Mailchimp List Subscribe Form [mailchimp]
Researcher
Mesmerize Companion <= 1.6.158 - Missing Authorization Authenticated (Subscriber+) Settings Update
4.3
Affected Software
Mesmerize Companion [mesmerize-companion]
Researcher
Affected Software
Researcher
Affected Software
Order Splitter for WooCommerce [woo-order-splitter]
Researcher
Affected Software
Page Title, Description & Open Graph Updater [page-title-description-open-graph-updater]
Researcher
Affected Software
PawFriends - Pet Shop and Veterinary WordPress Theme [pawfriends]
Researcher
Affected Software
PDF Invoices & Packing Slips for WooCommerce [woocommerce-pdf-invoices-packing-slips]
Researcher
Affected Software
PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus [capability-manager-enhanced]
Researcher
Affected Software
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login [custom-registration-form-builder-with-submission-manager]
Researcher
Affected Software
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login [custom-registration-form-builder-with-submission-manager]
Researcher
Affected Software
Remove Post Type Slug [remove-post-type-slug]
Researcher
Affected Software
GEO Plugin by Squirrly SEO [squirrly-seo]
Researcher
Affected Software
Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning [wp-simple-firewall]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Wallet for WooCommerce [woo-wallet]
Researcher
Affected Software
The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce [the-plus-addons-for-elementor-page-builder]
Researcher
Affected Software
Tickera – Sell Tickets & Manage Events [tickera-event-ticketing-system]
Researcher
Affected Software
Virusdie | One-click website security [virusdie]
Researcher
Affected Software
Whatsiplus Scheduled Notification for Woocommerce [whatsiplus-scheduled-notification-for-woocommerce]
Researcher
WP Plugin Info Card <= 6.2.0 - Cross-Site Request Forgery to Arbitrary Custom Plugin Entry Creation
4.3
Affected Software
WP Plugin Info Card [wp-plugin-info-card]
Researcher
Affected Software
WPC Product Bundles for WooCommerce [woo-product-bundle]
Researcher
Affected Software
WPC Smart Wishlist for WooCommerce [woo-smart-wishlist]
Researcher
Affected Software
Researcher
Affected Software
OneClick Chat to Order [oneclick-whatsapp-order]
Researcher
Affected Software
WP-DownloadManager [wp-downloadmanager]
Researcher
Affected Software
YayMail – WooCommerce Email Customizer [yaymail]
Researcher
As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.
This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
Comments