Title	CVE ID	CVSS	Vector	Date
HTML Forms <= 1.5.5 - Authenticated (Admin+) Stored Cross-Site Scripting	CVE-2025-12125	4.4	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N	November 7, 2025
AuthorSure <= 2.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting	CVE-2025-13134	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	November 20, 2025
Custom Post Type <= 1.0 - Cross-Site Request Forgery to Custom Post Type Deletion	CVE-2025-13142	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	November 20, 2025
Just Highlight <= 1.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Highlight Color' Setting	CVE-2025-13311	4.4	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N	November 24, 2025
Duplicate Content Cure <= 1.0 - Cross-Site Request Forgery	CVE-2025-59132	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	November 29, 2025
SurveyJS: Drag & Drop WordPress Form Builder <= 1.12.20 - Cross-Site Request Forgery to Survey Deletion	CVE-2025-13140	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	December 1, 2025
ContentStudio <= 1.3.7 - Cross-Site Request Forgery to Settings Update	CVE-2025-13144	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	December 4, 2025
ARK Related Posts <= 2.19 - Cross-Site Request Forgery to Settings Update	CVE-2025-13684	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	December 4, 2025
Live Sales Notification for Woocommerce – Woomotiv <= 3.6.3 - Reflected Cross-Site Scripting	CVE-2025-13137	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	December 5, 2025
Coding Blocks <= 1.1.0 - Cross-Site Request Forgery to Settings Update	CVE-2025-14158	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	December 11, 2025
BMLT WordPress Plugin <= 3.11.4 - Cross-Site Request Forgery to Settings Creation and Deletion	CVE-2025-14162	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	December 11, 2025
Upcoming for Calendly <= 1.2.4 - Cross-Site Request Forgery to Settings Update	CVE-2025-14160	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	December 11, 2025
Kirim.Email WooCommerce Integration <= 1.2.9 - Cross-Site Request Forgery to Settings Update	CVE-2025-14165	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	December 11, 2025
Resource Library for Logged In Users <= 1.5 - Cross-Site Request Forgery to Multiple Administrative Actions	CVE-2025-14354	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	December 11, 2025
Lucky Draw Contests <= 4.2 - Cross-Site Request Forgery to Plugin Settings Update	CVE-2025-14462	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	December 12, 2025
My auctions allegro <= 3.6.33 - Authenticated (Administrator+) Stored Cross-Site Scripting	CVE-2025-68566	4.4	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N	December 17, 2025
My auctions allegro <= 3.6.33 - Cross-Site Request Forgery	CVE-2025-68567	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	December 17, 2025
WP DB Booster <= 1.0.1 - Cross-Site Request Forgery to Database Cleanup	CVE-2025-14168	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	December 19, 2025
Quran Gateway <= 1.5 - Cross-Site Request Forgery to Settings Update	CVE-2025-14164	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	December 19, 2025
Basticom Framework <= 1.5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting	CVE-2025-67629	4.4	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N	December 21, 2025

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation