Wordfence Intelligence Weekly WordPress Vulnerability Report (July 20, 2026 to July 26, 2026)
Last week, there were 265 vulnerabilities disclosed in 213 WordPress Plugins and 6 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 118 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.
Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back.
Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 35,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
New Firewall Rules Deployed Last Week
The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.
The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:
Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.
Total Unpatched & Patched Vulnerabilities Last Week
| Patch Status | Number of Vulnerabilities |
|---|---|
| Patched | 211 |
| Unpatched | 54 |
Total Vulnerabilities by CVSS Severity Last Week
| Severity Rating | Number of Vulnerabilities |
|---|---|
| Medium Severity | 202 |
| High Severity | 50 |
| Critical Severity | 13 |
Total Vulnerabilities by CWE Type Last Week
| Vulnerability Type by CWE | Number of Vulnerabilities |
|---|---|
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 77 |
| Missing Authorization | 69 |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 29 |
| Exposure of Sensitive Information to an Unauthorized Actor | 15 |
| Cross-Site Request Forgery (CSRF) | 11 |
| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 9 |
| Authorization Bypass Through User-Controlled Key | 8 |
| Server-Side Request Forgery (SSRF) | 8 |
| Unrestricted Upload of File with Dangerous Type | 8 |
| Deserialization of Untrusted Data | 5 |
| Improper Control of Generation of Code ('Code Injection') | 4 |
| Client-Side Enforcement of Server-Side Security | 3 |
| Improper Authentication | 3 |
| Improper Input Validation | 3 |
| Improper Privilege Management | 3 |
| Incorrect Privilege Assignment | 3 |
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | 2 |
| Incorrect Authorization | 2 |
| Embedded Malicious Code | 1 |
| Relative Path Traversal | 1 |
| Use of Less Trusted Source | 1 |
Researchers That Contributed to WordPress Security Last Week
| Researcher Name | Number of Vulnerabilities |
|---|---|
| 49 | |
| 28 | |
| 6 | |
| 6 | |
| 6 | |
| 5 | |
| 5 | |
| 5 | |
| 4 | |
| 4 | |
| 4 | |
| 4 | |
| 4 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.
WordPress Plugins with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| Abandoned Cart Lite for WooCommerce | woocommerce-abandoned-cart |
| Academy LMS | academy |
| Accept Donations with PayPal & Stripe | easy-paypal-donation |
| Advanced Views – Display Framework for Gutenberg & Elementor | acf-views |
| AffiliateWP | affiliate-wp |
| AffiliateX – Amazon Affiliate Plugin, Product Boxes, Comparison Tables & Affiliate Link Tracking | affiliatex |
| AI Copilot – Content Generator | ai-copilot-content-generator |
| Appointment Hour Booking – Booking Calendar | appointment-hour-booking |
| ARforms | arforms |
| Authora : Easy login with mobile number | authora-easy-login-with-mobile-number |
| Avada Core | fusion-core |
| Avada Custom Branding | fusion-white-label-branding |
| AWP Classifieds | another-wordpress-classifieds-plugin |
| BetterDocs – AI Documentation, Knowledge Base, MCP Server, Docs, Wikis, FAQ & Chatbot | betterdocs |
| Blog Floating Button | blog-floating-button |
| Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment | booking-and-rental-manager-for-woocommerce |
| Brands for WooCommerce | brands-for-woocommerce |
| Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP | videowhisper-live-streaming-integration |
| BSK PDF Manager | bsk-pdf-manager |
| Buckaroo Woocommerce Payments Plugin | wc-buckaroo-bpe-gateway |
| Builderall for WordPress | builderall-cheetah-for-wp |
| Bulk Page Generator – LPagery | lpagery |
| Byteflows Travel & Hotel Booking | byteflows-travel-hotel-booking |
| ChamaWP – Monetize With Donations, Memberships, Crowdfunding, Commissions & Restricted Content | chama |
| Checkout Field Editor for WooCommerce (Pro) | woocommerce-checkout-field-editor-pro |
| Civi Framework | civi-framework |
| Classified Listing – AI-Powered Classified ads & Business Directory | classified-listing |
| Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer | clearfy |
| CoCart – Headless REST API for WooCommerce | cart-rest-api-for-woocommerce |
| Complianz GDPR/CCPA Cookie Consent Banner | complianz-gdpr |
| Content Control – The Ultimate Content Restriction Plugin! Restrict Content, Create Conditional Blocks & More | content-control |
| Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe | contest-gallery |
| Cozy Blocks – Website Builder for Block Editor | 59 Gutenberg Blocks, 700+ Patterns, 50+ Templates | cozy-addons |
| Create | mediavine-create |
| Create Block Theme | create-block-theme |
| Custom links in Elementor Image Carousel | custom-links-in-elementor-image-carousel |
| Customer Support Ticket System & Helpdesk | wp-ticket |
| Cyr to Lat Reloaded – Transliteration of Links and File Names | cyr-and-lat |
| Directory Listings WordPress plugin – uListing | ulisting |
| Ditty – Responsive News Tickers, Sliders, and Lists | ditty-news-ticker |
| Dokan Pro | dokan-pro |
| Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy | dokan-lite |
| DTX – Dynamic Text Extension for Contact Form 7 | contact-form-7-dynamic-text-extension |
| Dynamic Pricing With Discount Rules for WooCommerce | aco-woo-dynamic-pricing |
| Easy Appointments | easy-appointments |
| Easy Digital Downloads – eCommerce Payments and Subscriptions made easy | easy-digital-downloads |
| Easy Form Builder by WhiteStudio – Drag & Drop Form Builder | easy-form-builder |
| Ebook Store | ebook-store |
| Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance | accessibility-checker |
| eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams | eroom-zoom-meetings-webinar |
| Essential Addons for Elementor – Popular Elementor Templates & Widgets | essential-addons-for-elementor-lite |
| Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar | mage-eventpress |
| Event Post | event-post |
| Event Tickets and Registration | event-tickets |
| EventON Action User | eventon-action-user |
| Events Made Easy | events-made-easy |
| Falcon – Cache, Performance, Security, Cleanup, and Tweaks | falcon |
| Firelight Lightbox | easy-fancybox |
| Flipbook PDF Viewer & Embedder | pdf-embed-viewer |
| Fluent Forms Pro Add On Pack | fluentformpro |
| Fluent Support – Helpdesk & Customer Support Ticket System | fluent-support |
| FormCraft | formcraft3 |
| Gallery for Google Photos – share your albums right on your site | embed-google-photos |
| GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI | gamipress |
| GEO my WP | geo-my-wp |
| GiveWP – Donation Plugin and Fundraising Platform | give |
| GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more | godam |
| Google Maps Easy Pro | google-maps-easy-pro |
| Graphina – Charts and Graphs For Elementor | graphina-elementor-charts-and-graphs |
| Grid/List View for WooCommerce | gridlist-view-for-woocommerce |
| GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor | gutenkit-blocks-addon |
| HashThemes Demo Importer | hashthemes-demo-importer |
| Header Footer Script Adder | header-and-footer-script-adder |
| Hide My WP Ghost – Security & Firewall | hide-my-wp |
| Hubbub Lite – Fast, free social sharing and follow buttons | social-pug |
| Import and export users and customers | import-users-from-csv-with-meta |
| Improve SEO | improveseo |
| Insert or Embed Articulate Content into WordPress | insert-or-embed-articulate-content-into-wordpress |
| JetBooking | jet-booking |
| JetElements | jet-elements |
| JetEngine | jet-engine |
| Kali Forms — Contact Form & Drag-and-Drop Builder | kali-forms |
| King Addons for Elementor – 80+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce, Mega Menu, Popup Builder | king-addons |
| Kirki – Freeform Page Builder, Website Builder & Customizer | kirki |
| Kit (formerly ConvertKit) – Email Newsletter, Email Marketing, Membership, Subscribers and Landing Pages | convertkit |
| Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more | knit-pay |
| Kwayy HTML Sitemap | kwayy-html-sitemap |
| LA-Studio Element Kit for Elementor | lastudio-element-kit |
| License Manager for WooCommerce | license-manager-for-woocommerce |
| Link Library | link-library |
| LIQUID SPEECH BALLOON | liquid-speech-balloon |
| ListingPro Plugin | listingpro-plugin |
| LogMyTrip | logmytrip |
| Machete | machete |
| MailPoet – Newsletters, Email Marketing, and Automation | mailpoet |
| Mailster WordPress Newsletter Plugin | mailster |
| MapPress – Google Maps, OpenStreetMap & Leaflet | mappress-google-maps-for-wordpress |
| MapSVG | mapsvg |
| MapSVG – Vector maps, Image maps, Google Maps | mapsvg-lite-interactive-vector-maps |
| MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution | marketking-multivendor-marketplace-for-woocommerce |
| Masteriyo LMS – LMS Course Builder, Quizzes & Certificates | learning-management-system |
| MDJM Event Management | mobile-dj-manager |
| Mediavine Control Panel | mediavine-control-panel |
| miniOrange Discord Integration | miniorange-discord-integration |
| miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon | miniorange-login-openid |
| Modula Image Gallery – Photo Grid & Video Gallery | modula-best-grid-gallery |
| MountDev AI MCP Connector for WordPress | mountdev-ai-mcp-connector |
| MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar | mp3-music-player-by-sonaar |
| Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder | the-plus-addons-for-block-editor |
| Ninja Forms – The Contact Form Builder That Grows With You | ninja-forms |
| Ninja Tables – Easy Data Table Builder | ninja-tables |
| Open User Map – Interactive Leaflet Maps | open-user-map |
| Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More | themeisle-companion |
| Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction | paid-member-subscriptions |
| Participants Database | participants-database |
| Payment Gateway for PayPal on WooCommerce | woo-paypal-gateway |
| Payment Plugins for Stripe WooCommerce | woo-stripe-payment |
| PayU India | payu-india |
| PeproDev Ultimate Invoice | pepro-ultimate-invoice |
| Personal QR Message | personal-qr-message |
| Photo Block – A Modern Image Block With Lightbox and Caption Support | photo-block |
| Photo Gallery – GT3 Image Gallery & Gutenberg Block Gallery | gt3-photo-video-gallery |
| Photo Gallery – Responsive Image Galleries by Supsystic | gallery-by-supsystic |
| Picture Gallery – Frontend Image Uploads, AJAX Photo List | picture-gallery |
| PiWeb Product Enquiry or product catalog for WooCommerce | enquiry-quotation-for-woocommerce |
| Pixel Tag Manager for WooCommerce – Google Analytics 4, Google Ads, and More Pixels | pixel-manager-for-woocommerce |
| Polylang | polylang |
| Popup for CF7 with Sweet Alert | cf7-sweet-alert-popup |
| Post Grid Gutenberg Blocks – PostX | ultimate-post |
| Post My CF7 Form | post-my-contact-form-7 |
| Premium Packages – Sell Digital Products Securely | wpdm-premium-packages |
| Product Designer for WooCommerce WordPress | Lumise | lumise |
| Product Slider, Product Grid, Product Masonry | woocommerce-products-slider |
| ProfileGrid – User Profiles, Groups and Communities | profilegrid-user-profiles-groups-and-communities |
| Qubely – Advanced Gutenberg Blocks | qubely |
| Query Wrangler | query-wrangler |
| QuickCal | quickcal |
| Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker | quiz-master-next |
| Real Estate Manager Pro | real-estate-manager-pro |
| Really Simple CSV Importer | really-simple-csv-importer |
| RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login | custom-registration-form-builder-with-submission-manager |
| Registrations for the Events Calendar – Event Registration Plugin | registrations-for-the-events-calendar |
| Relevanssi Light | relevanssi-light |
| reviewer | reviewer |
| RexFeed – Product Feed Manager for WooCommerce – Sell on 200+ Shopping Channels | best-woocommerce-feed |
| Rich Showcase for Google Reviews | widget-google-reviews |
| RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg | rt-mega-menu |
| rtMedia for WordPress, BuddyPress and bbPress | buddypress-media |
| SAML Single Sign On – SSO Login | miniorange-saml-20-single-sign-on |
| Security Optimizer – The All-In-One Protection Plugin | sg-security |
| Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce | sender-net-automated-emails |
| Shiptastic for WooCommerce | shiptastic-for-woocommerce |
| ShipTime: Discount Shipping | shiptime-discount-shipping |
| Simple Google Calendar Outlook Events Widget | simple-google-icalendar-widget |
| Simple Membership | simple-membership |
| Simple Restrict | simple-restrict |
| Simply Schedule Appointments | simply-schedule-appointments |
| Slider Pro | sliderpro |
| sm page duplicator | sm-page-duplicator |
| Smart Manager – WooCommerce Bulk Edit: Products, Orders, Users & More (Spreadsheet) | smart-manager-for-wp-e-commerce |
| Smart SEO Tool – SEO优化插件 | smart-seo-tool |
| SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery | sms-alert |
| Spectra Legacy – Gutenberg Blocks | ultimate-addons-for-gutenberg |
| Style Kits for Elementor | analogwp-templates |
| SUMO Reward Points for WooCommerce | rewardsystem |
| Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers | sunshine-photo-cart |
| Super Store Finder | superstorefinder-wp |
| Supsystic Gallery Pro | supsystic-gallery-pro |
| SureDash – Community, Courses & Member Dashboard | suredash |
| SVG Support | svg-support |
| Tables Generator Pro | tables-generator-pro |
| Tabs Responsive – With WooCommerce Product Tabs Extension | tabs-responsive |
| Tag, Category, and Taxonomy Manager – Autotagger Automatically Add Terms | simple-tags |
| TemplateSpare – 1000+ WordPress Starter Templates & Full Site Migration Tool | 1-Click Import/Export & No-Code Builder | templatespare |
| Thrive Quiz Builder | thrive-quiz-builder |
| Thrive Themes – Product Manager | thrive-product-manager |
| Tickera – Sell Tickets & Manage Events | tickera-event-ticketing-system |
| TinyMCE Templates | tinymce-templates |
| Tonda Core | tonda-core |
| Tutor LMS Elementor Addons | tutor-lms-elementor-addons |
| Ultimate Addons for Elementor – Widgets, Templates, WooCommerce & Header Footer Builder | header-footer-elementor |
| Ultimate Store Kit | ultimate-store-kit |
| Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included | uncanny-automator |
| Video Player for YouTube – Embed Videos Your Visitors Will Love to Watch | yt-player |
| VikBooking Hotel Booking Engine & PMS | vikbooking |
| Virtue/Ascend/Pinnacle Toolkit | virtue-toolkit |
| Visual Composer Website Builder | visualcomposer |
| Visualizer – Tables & Charts Manager with Built-in AI Generator | visualizer |
| WCPOS – Point of Sale (POS) plugin for WooCommerce | woocommerce-pos |
| Web Push Notifications – Webpushr | webpushr-web-push-notifications |
| WP Accessibility Helper (WAH) | wp-accessibility-helper |
| WP Activity Log | wp-security-audit-log |
| WP BASE Booking of Appointments, Services and Events | wp-base-booking-of-appointments-services-and-events |
| WP Easy Pay – Payment and Donation Form Builder for Square | wp-easy-pay |
| WP Encryption – One Click SSL / HTTPS & Free SSL Certificate, HTTPS Redirect, Security | wp-letsencrypt-ssl |
| WP Fast Total Search – The Power of Indexed Search | fulltext-search |
| WP Foodbakery | wp-foodbakery |
| WP Go Maps – Google Map, OpenStreetMap, Leaflet Map | wp-google-maps |
| WP Hotel Booking | wp-hotel-booking |
| WP Shortcode by MyThemeShop | wp-shortcode |
| WP Social Ninja – Embed Social Feeds, User Reviews & Chat Widgets | wp-social-reviews |
| WP-Polls | wp-polls |
| WPForms Pro | wpforms |
| WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More | wpforms-lite |
| wpForo Forum | wpforo |
| WPify Woo – Withdrawal, CRN/VAT, QR payments, Heureka and more for WooCommerce | wpify-woo |
| WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) | wpo365-login |
| Yoast SEO – Advanced SEO with real-time guidance and built-in AI | wordpress-seo |
| Ziina | ziina |
| ЮKassa для WooCommerce | yookassa |
| افزونه حمل و نقل ووکامرس | پست پیشتاز، تیپاکس و پیک موتوری | persian-woocommerce-shipping |
| افزونه پرداخت امن زرینپال برای ووکامرس (ZarinPal for WooCommerce) | zarinpal-woocommerce-payment-gateway |
| افزونه پیامک ووکامرس Persian WooCommerce SMS | persian-woocommerce-sms |
WordPress Themes with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| Civi - Job Board & Freelance Marketplace WordPress Theme | civi |
| Grand Photography WordPress | grandphotography |
| Manual - Documentation, Knowledge Base & Education WordPress Theme | manual |
| photography | photography |
| TheGem | thegem-elementor |
| Vino - A Refined Winery, Wine Bar and Vineyard WordPress Theme | vino |
Vulnerability Details
Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.
Affected Software
Authora : Easy login with mobile number [authora-easy-login-with-mobile-number]
Researcher
Affected Software
Customer Support Ticket System & Helpdesk [wp-ticket]
Researcher
Affected Software
Easy Form Builder by WhiteStudio – Drag & Drop Form Builder [easy-form-builder]
Researcher
Affected Software
Researcher
Affected Software
Improve SEO [improveseo]
Researcher
Affected Software
MountDev AI MCP Connector for WordPress [mountdev-ai-mcp-connector]
Researcher
Affected Software
Google Maps Easy Pro [google-maps-easy-pro]
Supsystic Gallery Pro [supsystic-gallery-pro]
Tables Generator Pro [tables-generator-pro]
Researcher
Affected Software
Personal QR Message [personal-qr-message]
Researcher
Affected Software
SAML Single Sign On – SSO Login [miniorange-saml-20-single-sign-on]
Researcher
Affected Software
Researcher
Affected Software
WP BASE Booking of Appointments, Services and Events [wp-base-booking-of-appointments-services-and-events]
Researcher
Affected Software
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP [videowhisper-live-streaming-integration]
Researcher
Affected Software
Participants Database [participants-database]
Researcher
Affected Software
Create Block Theme [create-block-theme]
Researcher
Affected Software
Fluent Forms Pro Add On Pack [fluentformpro]
Researcher
Affected Software
MDJM Event Management [mobile-dj-manager]
Researcher
Affected Software
Researcher
Affected Software
Easy Appointments [easy-appointments]
Researcher
Affected Software
Kali Forms — Contact Form & Drag-and-Drop Builder [kali-forms]
Researcher
Affected Software
Picture Gallery – Frontend Image Uploads, AJAX Photo List [picture-gallery]
Researcher
Affected Software
Thrive Quiz Builder [thrive-quiz-builder]
Researcher
Affected Software
WP Foodbakery [wp-foodbakery]
Researcher
Affected Software
WPForms Pro [wpforms]
Researcher
Affected Software
Researcher
Affected Software
AWP Classifieds [another-wordpress-classifieds-plugin]
Researcher
Affected Software
Researcher
Affected Software
Link Library [link-library]
Researcher
Affected Software
LogMyTrip [logmytrip]
Affected Software
MapSVG – Vector maps, Image maps, Google Maps [mapsvg-lite-interactive-vector-maps]
Researcher
Affected Software
MapSVG [mapsvg]
Researcher
Affected Software
Participants Database [participants-database]
Researcher
Affected Software
Researcher
Affected Software
Relevanssi Light [relevanssi-light]
Researcher
Affected Software
rtMedia for WordPress, BuddyPress and bbPress [buddypress-media]
Researcher
Affected Software
Super Store Finder [superstorefinder-wp]
Researcher
Affected Software
Tonda Core [tonda-core]
Researcher
Affected Software
Researcher
Affected Software
EventON Action User [eventon-action-user]
Researcher
Affected Software
Flipbook PDF Viewer & Embedder [pdf-embed-viewer]
Researcher
Affected Software
Researcher
Affected Software
ARforms [arforms]
Researcher
Affected Software
Blog Floating Button [blog-floating-button]
Researcher
Affected Software
Dynamic Pricing With Discount Rules for WooCommerce [aco-woo-dynamic-pricing]
Researcher
Affected Software
Easy Form Builder by WhiteStudio – Drag & Drop Form Builder [easy-form-builder]
Researcher
FormCraft <= 3.9.14 - Unauthenticated Stored Cross-Site Scripting via Matrix Field Sub-Parameters
7.2
Affected Software
FormCraft [formcraft3]
Researcher
Affected Software
Insert or Embed Articulate Content into WordPress [insert-or-embed-articulate-content-into-wordpress]
Researcher
Affected Software
JetBooking [jet-booking]
Researcher
Affected Software
Mailster WordPress Newsletter Plugin [mailster]
Researcher
Affected Software
Researcher
Affected Software
MapSVG – Vector maps, Image maps, Google Maps [mapsvg-lite-interactive-vector-maps]
Researcher
Affected Software
MapSVG – Vector maps, Image maps, Google Maps [mapsvg-lite-interactive-vector-maps]
Researcher
Affected Software
PeproDev Ultimate Invoice [pepro-ultimate-invoice]
Researcher
Affected Software
PeproDev Ultimate Invoice [pepro-ultimate-invoice]
Researcher
Affected Software
PiWeb Product Enquiry or product catalog for WooCommerce [enquiry-quotation-for-woocommerce]
Researcher
Affected Software
RexFeed – Product Feed Manager for WooCommerce – Sell on 200+ Shopping Channels [best-woocommerce-feed]
Researcher
Affected Software
Really Simple CSV Importer [really-simple-csv-importer]
Researcher
Simple Google Calendar Outlook Events Widget <= 3.0.0 - Unauthenticated Server-Side Request Forgery
7.2
Affected Software
Simple Google Calendar Outlook Events Widget [simple-google-icalendar-widget]
Affected Software
Simple Membership [simple-membership]
Researcher
Affected Software
Smart Manager – WooCommerce Bulk Edit: Products, Orders, Users & More (Spreadsheet) [smart-manager-for-wp-e-commerce]
Researcher
Affected Software
SUMO Reward Points for WooCommerce [rewardsystem]
Researcher
Affected Software
VikBooking Hotel Booking Engine & PMS [vikbooking]
Researcher
Affected Software
Researcher
Complianz – GDPR/CCPA Cookie Consent <= 7.5.1 - Authenticated (Administrator+) PHP Object Injection
6.6
Affected Software
Complianz GDPR/CCPA Cookie Consent Banner [complianz-gdpr]
Researcher
Affected Software
AI Copilot – Content Generator [ai-copilot-content-generator]
Researcher
Affected Software
Checkout Field Editor for WooCommerce (Pro) [woocommerce-checkout-field-editor-pro]
Researcher
Contact Form 7 – Dynamic Text Extension <= 5.0.6 - Unauthenticated Arbitrary Shortcode Execution
6.5
Affected Software
DTX – Dynamic Text Extension for Contact Form 7 [contact-form-7-dynamic-text-extension]
Researcher
Affected Software
Create [mediavine-create]
Researcher
Affected Software
eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams [eroom-zoom-meetings-webinar]
Researcher
MapSVG – Vector maps, Image maps, Google Maps <= 8.14.0 - Authenticated (Contributor+) SQL Injection
6.5
Affected Software
MapSVG – Vector maps, Image maps, Google Maps [mapsvg-lite-interactive-vector-maps]
Researcher
Affected Software
MapSVG [mapsvg]
Researcher
Affected Software
Premium Packages – Sell Digital Products Securely [wpdm-premium-packages]
Researcher
Affected Software
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker [quiz-master-next]
Researcher
Affected Software
Registrations for the Events Calendar – Event Registration Plugin [registrations-for-the-events-calendar]
Researcher
rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 - Authenticated (Subscriber+) SQL Injection
6.5
Affected Software
rtMedia for WordPress, BuddyPress and bbPress [buddypress-media]
Researcher
Affected Software
Tickera – Sell Tickets & Manage Events [tickera-event-ticketing-system]
Researcher
Tickera <= 3.6.0.1 - Authenticated (Staff+) SQL Injection via 'tc_order_status_filter' Parameter
6.5
Affected Software
Tickera – Sell Tickets & Manage Events [tickera-event-ticketing-system]
Researcher
Affected Software
Researcher
Affected Software
WCPOS – Point of Sale (POS) plugin for WooCommerce [woocommerce-pos]
Researcher
Affected Software
Accept Donations with PayPal & Stripe [easy-paypal-donation]
Researcher
Affected Software
Appointment Hour Booking – Booking Calendar [appointment-hour-booking]
Researcher
Affected Software
Researcher
Affected Software
Brands for WooCommerce [brands-for-woocommerce]
Researcher
Affected Software
Brands for WooCommerce [brands-for-woocommerce]
Researcher
Affected Software
BSK PDF Manager [bsk-pdf-manager]
Researcher
Affected Software
Bulk Page Generator – LPagery [lpagery]
Researcher
Complianz – GDPR/CCPA Cookie Consent <= 7.5.1 - Authenticated (Author+) Server-Side Request Forgery
6.4
Affected Software
Complianz GDPR/CCPA Cookie Consent Banner [complianz-gdpr]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Custom links in Elementor Image Carousel [custom-links-in-elementor-image-carousel]
Researcher
Affected Software
Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance [accessibility-checker]
Researcher
Affected Software
Essential Addons for Elementor – Popular Elementor Templates & Widgets [essential-addons-for-elementor-lite]
Researcher
Affected Software
Essential Addons for Elementor – Popular Elementor Templates & Widgets [essential-addons-for-elementor-lite]
Researcher
Event Booking Manager for WooCommerce <= 5.3.6 - Authenticated (Author+) Stored Cross-Site Scripting
6.4
Affected Software
Researcher
Affected Software
Firelight Lightbox [easy-fancybox]
Researcher
Affected Software
Fluent Support – Helpdesk & Customer Support Ticket System [fluent-support]
Researcher
Affected Software
Fluent Support – Helpdesk & Customer Support Ticket System [fluent-support]
Researcher
Affected Software
Grid/List View for WooCommerce [gridlist-view-for-woocommerce]
Researcher
Affected Software
HashThemes Demo Importer [hashthemes-demo-importer]
Researcher
Affected Software
Header Footer Script Adder [header-and-footer-script-adder]
Researcher
Affected Software
Researcher
Affected Software
JetElements [jet-elements]
Researcher
Affected Software
JetEngine [jet-engine]
Researcher
Affected Software
LA-Studio Element Kit for Elementor [lastudio-element-kit]
Researcher
Affected Software
LIQUID SPEECH BALLOON [liquid-speech-balloon]
Researcher
Affected Software
Machete [machete]
Researcher
Affected Software
Researcher
Affected Software
MapSVG – Vector maps, Image maps, Google Maps [mapsvg-lite-interactive-vector-maps]
Researcher
Affected Software
MapSVG – Vector maps, Image maps, Google Maps [mapsvg-lite-interactive-vector-maps]
Researcher
Affected Software
miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon [miniorange-login-openid]
Researcher
Affected Software
Modula Image Gallery – Photo Grid & Video Gallery [modula-best-grid-gallery]
Researcher
Affected Software
Open User Map – Interactive Leaflet Maps [open-user-map]
Researcher
Affected Software
Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More [themeisle-companion]
Researcher
Affected Software
Researcher
Affected Software
Photo Gallery – GT3 Image Gallery & Gutenberg Block Gallery [gt3-photo-video-gallery]
Researcher
Affected Software
Post Grid Gutenberg Blocks – PostX [ultimate-post]
Researcher
Affected Software
Rich Showcase for Google Reviews [widget-google-reviews]
Researcher
Affected Software
RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg [rt-mega-menu]
Researcher
Affected Software
Slider Pro [sliderpro]
Researcher
Affected Software
Smart SEO Tool – SEO优化插件 [smart-seo-tool]
Researcher
Affected Software
Spectra Legacy – Gutenberg Blocks [ultimate-addons-for-gutenberg]
Researcher
Affected Software
Researcher
Affected Software
SVG Support [svg-support]
Researcher
Affected Software
TheGem [thegem-elementor]
Researcher
Affected Software
Ultimate Addons for Elementor – Widgets, Templates, WooCommerce & Header Footer Builder [header-footer-elementor]
Researcher
Affected Software
Ultimate Store Kit [ultimate-store-kit]
Researcher
Virtue/Ascend/Pinnacle Toolkit <= 4.9.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
Virtue/Ascend/Pinnacle Toolkit [virtue-toolkit]
Researcher
Affected Software
Researcher
Affected Software
Web Push Notifications – Webpushr [webpushr-web-push-notifications]
Researcher
Affected Software
WP Hotel Booking [wp-hotel-booking]
Researcher
Affected Software
WP Shortcode by MyThemeShop [wp-shortcode]
Researcher
Affected Software
wpForo Forum [wpforo]
Researcher
Yoast SEO <= 28.0 - Authenticated (Author+) Stored Cross-Site Scripting via Post Slug (post_name)
6.4
Affected Software
Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo]
Researcher
Affected Software
Premium Packages – Sell Digital Products Securely [wpdm-premium-packages]
Researcher
Affected Software
AffiliateWP [affiliate-wp]
Researcher
Affected Software
Grand Photography WordPress [grandphotography]
Researcher
Affected Software
Researcher
Affected Software
Real Estate Manager Pro [real-estate-manager-pro]
Researcher
Affected Software
VikBooking Hotel Booking Engine & PMS [vikbooking]
Researcher
Affected Software
AWP Classifieds [another-wordpress-classifieds-plugin]
Researcher
Affected Software
Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment [booking-and-rental-manager-for-woocommerce]
Researcher
Affected Software
Builderall for WordPress [builderall-cheetah-for-wp]
Researcher
Affected Software
Byteflows Travel & Hotel Booking [byteflows-travel-hotel-booking]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Civi Framework [civi-framework]
Researcher
Affected Software
CoCart – Headless REST API for WooCommerce [cart-rest-api-for-woocommerce]
Researcher
Affected Software
CoCart – Headless REST API for WooCommerce [cart-rest-api-for-woocommerce]
Researcher
Affected Software
Complianz GDPR/CCPA Cookie Consent Banner [complianz-gdpr]
Researcher
Affected Software
Researcher
Affected Software
Create [mediavine-create]
Researcher
Affected Software
Ditty – Responsive News Tickers, Sliders, and Lists [ditty-news-ticker]
Researcher
Affected Software
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads]
Researcher
Affected Software
Ebook Store [ebook-store]
Researcher
Affected Software
Ebook Store [ebook-store]
Researcher
Affected Software
Ebook Store [ebook-store]
Researcher
Affected Software
Event Post [event-post]
Researcher
Affected Software
Event Tickets and Registration [event-tickets]
Researcher
Affected Software
Events Made Easy [events-made-easy]
Researcher
Affected Software
Researcher
Affected Software
Gallery for Google Photos – share your albums right on your site [embed-google-photos]
Researchers
Affected Software
Graphina – Charts and Graphs For Elementor [graphina-elementor-charts-and-graphs]
Researcher
Affected Software
GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor [gutenkit-blocks-addon]
Researcher
Affected Software
WP Hotel Booking [wp-hotel-booking]
Researcher
Affected Software
JetBooking [jet-booking]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
LA-Studio Element Kit for Elementor [lastudio-element-kit]
Researcher
Affected Software
Researcher
MapPress – Google Maps, OpenStreetMap & Leaflet <= 2.97.6 - Unauthenticated Information Exposure
5.3
Affected Software
MapPress – Google Maps, OpenStreetMap & Leaflet [mappress-google-maps-for-wordpress]
Researcher
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution <= 2.1.40 - Missing Authorization
5.3
Affected Software
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution [marketking-multivendor-marketplace-for-woocommerce]
Researcher
Affected Software
miniOrange Discord Integration [miniorange-discord-integration]
Researcher
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar <= 5.12 - Missing Authorization
5.3
Affected Software
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar [mp3-music-player-by-sonaar]
Researcher
Affected Software
Ninja Tables – Easy Data Table Builder [ninja-tables]
Researcher
Affected Software
Participants Database [participants-database]
Researcher
Affected Software
Payment Gateway for PayPal on WooCommerce [woo-paypal-gateway]
Researcher
Affected Software
Payment Plugins for Stripe WooCommerce [woo-stripe-payment]
Researcher
Affected Software
Payment Plugins for Stripe WooCommerce [woo-stripe-payment]
Researcher
Affected Software
PayU India [payu-india]
Researcher
Affected Software
PeproDev Ultimate Invoice [pepro-ultimate-invoice]
Researcher
Affected Software
PeproDev Ultimate Invoice [pepro-ultimate-invoice]
Researcher
Affected Software
photography [photography]
Researcher
Affected Software
Pixel Tag Manager for WooCommerce – Google Analytics 4, Google Ads, and More Pixels [pixel-manager-for-woocommerce]
Researcher
Affected Software
Post My CF7 Form [post-my-contact-form-7]
Researcher
Affected Software
Qubely – Advanced Gutenberg Blocks [qubely]
Researcher
Affected Software
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login [custom-registration-form-builder-with-submission-manager]
Researcher
Affected Software
Security Optimizer – The All-In-One Protection Plugin [sg-security]
Researcher
Affected Software
Shiptastic for WooCommerce [shiptastic-for-woocommerce]
Researcher
Affected Software
Simple Membership [simple-membership]
Researcher
Affected Software
Thrive Themes – Product Manager [thrive-product-manager]
Researcher
Affected Software
Ultimate Store Kit [ultimate-store-kit]
Researcher
Affected Software
WP Fast Total Search – The Power of Indexed Search [fulltext-search]
Researcher
Affected Software
WP Go Maps – Google Map, OpenStreetMap, Leaflet Map [wp-google-maps]
Researcher
Affected Software
WP Social Ninja – Embed Social Feeds, User Reviews & Chat Widgets [wp-social-reviews]
Researcher
Affected Software
Researcher
Affected Software
Import and export users and customers [import-users-from-csv-with-meta]
Researcher
Ninja Forms <= 3.14.9 - Authenticated (Administrator+) SQL Injection via Import File 'settings' Key
4.9
Affected Software
Researcher
Affected Software
Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce [sender-net-automated-emails]
Researcher
Affected Software
sm page duplicator [sm-page-duplicator]
Affected Software
Researcher
Affected Software
Researcher
افزونه پیامک ووکامرس Persian WooCommerce SMS <= 7.2.2 - Authenticated (Shop manager+) SQL Injection
4.9
Affected Software
افزونه پیامک ووکامرس Persian WooCommerce SMS [persian-woocommerce-sms]
Researcher
Affected Software
Abandoned Cart Lite for WooCommerce [woocommerce-abandoned-cart]
Researcher
Affected Software
Brands for WooCommerce [brands-for-woocommerce]
Researcher
Affected Software
Photo Gallery – Responsive Image Galleries by Supsystic [gallery-by-supsystic]
Researcher
Affected Software
Tabs Responsive – With WooCommerce Product Tabs Extension [tabs-responsive]
Researcher
Affected Software
Researcher
Affected Software
WP-Polls [wp-polls]
Researcher
Affected Software
Academy LMS [academy]
Researcher
Affected Software
Researcher
Affected Software
Avada Core [fusion-core]
Researcher
Affected Software
Avada Custom Branding [fusion-white-label-branding]
Researcher
Affected Software
Classified Listing – AI-Powered Classified ads & Business Directory [classified-listing]
Researcher
Affected Software
Classified Listing – AI-Powered Classified ads & Business Directory [classified-listing]
Researcher
Affected Software
Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe [contest-gallery]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams [eroom-zoom-meetings-webinar]
Researcher
Affected Software
GEO my WP [geo-my-wp]
Researcher
Affected Software
Researcher
Affected Software
Kwayy HTML Sitemap [kwayy-html-sitemap]
Researcher
Affected Software
LA-Studio Element Kit for Elementor [lastudio-element-kit]
Researcher
License Manager for WooCommerce <= 3.0.17 - Authenticated (Customer+) Arbitrary Content Deletion
4.3
Affected Software
License Manager for WooCommerce [license-manager-for-woocommerce]
Researcher
Affected Software
ListingPro Plugin [listingpro-plugin]
Researcher
MailPoet – Newsletters, Email Marketing, and Automation 5.30.0-5.33.0 - Cross-Site Request Forgery
4.3
Affected Software
Researcher
Affected Software
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates [learning-management-system]
Researcher
Affected Software
Mediavine Control Panel [mediavine-control-panel]
Researcher
Affected Software
Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder [the-plus-addons-for-block-editor]
Researcher
Affected Software
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction [paid-member-subscriptions]
Researcher
Affected Software
Participants Database [participants-database]
Researcher
Affected Software
Polylang [polylang]
Researcher
Affected Software
Popup for CF7 with Sweet Alert [cf7-sweet-alert-popup]
Researcher
Affected Software
Product Slider, Product Grid, Product Masonry [woocommerce-products-slider]
Researcher
Affected Software
ProfileGrid – User Profiles, Groups and Communities [profilegrid-user-profiles-groups-and-communities]
Researcher
Affected Software
Query Wrangler [query-wrangler]
Researcher
Affected Software
ShipTime: Discount Shipping [shiptime-discount-shipping]
Researcher
Affected Software
Simple Restrict [simple-restrict]
Researcher
Affected Software
Simply Schedule Appointments [simply-schedule-appointments]
Researcher
Affected Software
Spectra Legacy – Gutenberg Blocks [ultimate-addons-for-gutenberg]
Researcher
Affected Software
Style Kits for Elementor [analogwp-templates]
Researcher
Affected Software
Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers [sunshine-photo-cart]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
TinyMCE Templates [tinymce-templates]
Researcher
Affected Software
Tutor LMS Elementor Addons [tutor-lms-elementor-addons]
Researcher
Affected Software
Visual Composer Website Builder [visualcomposer]
Researcher
Affected Software
Buckaroo Woocommerce Payments Plugin [wc-buckaroo-bpe-gateway]
Researcher
Affected Software
WP Accessibility Helper (WAH) [wp-accessibility-helper]
Researcher
Affected Software
WP Activity Log [wp-security-audit-log]
Researcher
Affected Software
Researcher
Affected Software
Hide My WP Ghost – Security & Firewall [hide-my-wp]
Researcher
Affected Software
ЮKassa для WooCommerce [yookassa]
Researcher
Affected Software
افزونه پرداخت امن زرینپال برای ووکامرس (ZarinPal for WooCommerce) [zarinpal-woocommerce-payment-gateway]
Researcher
افزونه حمل و نقل ووکامرس | پست پیشتاز، تیپاکس و پیک موتوری <= 4.4.5 - Cross-Site Request Forgery
4.3
Affected Software
افزونه حمل و نقل ووکامرس | پست پیشتاز، تیپاکس و پیک موتوری [persian-woocommerce-shipping]
Researcher
As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.
This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
Comments