Last week, there were 277 vulnerabilities disclosed in 187 WordPress Plugins and 7 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 153 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.
Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back.
Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 35,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
New Firewall Rules Deployed Last Week
The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.
The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:
- WAF-RULE-956 – Data redacted while we work with the vendor on a patch.
Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.
Total Unpatched & Patched Vulnerabilities Last Week
| Patch Status | Number of Vulnerabilities |
|---|---|
| Patched | 254 |
| Unpatched | 23 |
Total Vulnerabilities by CVSS Severity Last Week
| Severity Rating | Number of Vulnerabilities |
|---|---|
| Low Severity | 1 |
| Medium Severity | 185 |
| High Severity | 75 |
| Critical Severity | 16 |
Total Vulnerabilities by CWE Type Last Week
| Vulnerability Type by CWE | Number of Vulnerabilities |
|---|---|
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 91 |
| Missing Authorization | 52 |
| Authorization Bypass Through User-Controlled Key | 19 |
| Exposure of Sensitive Information to an Unauthorized Actor | 17 |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 16 |
| Improper Privilege Management | 14 |
| Deserialization of Untrusted Data | 10 |
| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 9 |
| Improper Control of Generation of Code ('Code Injection') | 7 |
| Server-Side Request Forgery (SSRF) | 7 |
| Cross-Site Request Forgery (CSRF) | 6 |
| Improper Authentication | 6 |
| Client-Side Enforcement of Server-Side Security | 5 |
| Uncontrolled Resource Consumption | 5 |
| Unrestricted Upload of File with Dangerous Type | 5 |
| Insufficient Verification of Data Authenticity | 2 |
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | 1 |
| Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') | 1 |
| Improper Neutralization of Special Elements used in a Command ('Command Injection') | 1 |
| Incorrect Authorization | 1 |
| Unverified Password Change | 1 |
| URL Redirection to Untrusted Site ('Open Redirect') | 1 |
Researchers That Contributed to WordPress Security Last Week
| Researcher Name | Number of Vulnerabilities |
|---|---|
| 17 | |
| 12 | |
| 11 | |
| 9 | |
| 7 | |
| 6 | |
| 6 | |
| 5 | |
| 5 | |
| 5 | |
| 5 | |
| 5 | |
| 4 | |
| 4 | |
| 4 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.
WordPress Plugins with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| Abandoned Cart Pro for WooCommerce | woocommerce-abandon-cart-pro |
| Accept Stripe Payments | stripe-payments |
| ACPT (Premium) | advanced-custom-post-type |
| Activity Log – Monitor User and Agent Changes | aryo-activity-log |
| Advanced Custom Fields: Extended | acf-extended |
| Affiliate Super Assistent | amazonsimpleadmin |
| Agentimus – AI SEO, llms.txt & MCP for AI Agents | agentimus |
| All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) | all-in-one-seo-pack |
| Authorizer | authorizer |
| B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More | b2bking-wholesale-for-woocommerce |
| bbPress | bbpress |
| Beaver Builder Plugin (Starter Version) | bb-plugin |
| Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots | bp-better-messages |
| BetterDocs – AI Documentation, Knowledge Base, MCP Server, Docs, Wikis, FAQ & Chatbot | betterdocs |
| Blocksy Companion | blocksy-companion |
| Bold Page Builder | bold-page-builder |
| Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment | booking-and-rental-manager-for-woocommerce |
| Booking for Appointments and Events Calendar – Amelia | ameliabooking |
| Booking Hub - AI-Powered Scheduling, Reservation and Appointment System for WordPress | booking-hub |
| Bookit — Booking & Appointment Calendar | bookit |
| Breadcrumb NavXT | breadcrumb-navxt |
| Breakdance | breakdance |
| Bricksforge | bricksforge |
| Broken Link Checker | broken-link-checker |
| Business Directory Plugin – Easy Listing & Member Directories for WordPress | business-directory-plugin |
| Calculation for contact form 7 | calculation-for-contact-form-7 |
| CatalogX – Catalog Mode, Enquiry & Quotes for WooCommerce | woocommerce-catalog-enquiry |
| CatFolders Document Gallery & PDF Library | catfolders-document-gallery |
| Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) | charitable |
| Classified Listing – AI-Powered Classified ads & Business Directory | classified-listing |
| Comments – wpDiscuz | wpdiscuz |
| Contact Form by Supsystic | contact-form-by-supsystic |
| Content Views – Post Grid & Filter (Shortcode, Blocks, Elementor Widgets) | content-views-query-and-display-post-page |
| Cozy Blocks – Website Builder for Block Editor | 58 Gutenberg Blocks, 700+ Patterns, 50+ Templates | cozy-addons |
| Custom Contact Forms | custom-contact-forms |
| Customer Reviews for WooCommerce | customer-reviews-woocommerce |
| DearFlip – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer | 3d-flipbook-dflip-lite |
| DevKit Pro | devkit |
| Directorist: AI-Powered Business Directory, Listings & Classified Ads | directorist |
| Divi Ajax Filter | divi-ajax-filter |
| E-cab Taxi Booking Manager for Woocommerce | ecab-taxi-booking-manager |
| Easy Waveform Player | easy-waveform-player |
| EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents | embedpress |
| ePayco plugin for WooCommerce | epayco-gateway |
| Estatik Real Estate Plugin | estatik |
| Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce | wp-event-solution |
| Events Manager – Calendar, Bookings, Tickets, and more! | events-manager |
| EWWW Image Optimizer | ewww-image-optimizer |
| FAQ Builder AYS | faq-builder-ays |
| Flamingo | flamingo |
| Fluent Booking Pro | fluent-booking-pro |
| FormLayer | formlayer |
| Frontend Admin by DynamiApps | acf-frontend-form-element |
| FS Poster - WordPress Social media Auto Poster & Scheduler [Facebook, Instagram, Twitter, Pinterest] | fs-poster |
| Gallery : FooGallery | foogallery |
| Gallery PhotoBlocks | photoblocks-grid-gallery |
| GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI | gamipress |
| GeoDirectory – WP Business Directory Plugin and Classified Listings Directory | geodirectory |
| Gravity Forms | gravityforms |
| Greenshift – animation and page builder blocks | greenshift-animation-and-page-builder-blocks |
| Groundhogg — CRM, Newsletters, and Marketing Automation | groundhogg |
| GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor | gutenkit-blocks-addon |
| Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor | gutentor |
| HEL Online Classroom: AI-powered Online Classrooms | hel-online-classroom |
| HivePress Authentication | hivepress-authentication |
| Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN | hummingbird-performance |
| iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more | iubenda-cookie-law-solution |
| JCH Optimize | jch-optimize |
| JetBackup – Backup, Restore & Migrate | backup |
| JetFormBuilder — Dynamic Blocks Form Builder | jetformbuilder |
| Jetpack – WP Security, Backup, Speed, & Growth | jetpack |
| JetPopup | jet-popup |
| JetStyleManager for Gutenberg | jet-style-manager |
| JobSearch WP Job Board | wp-jobsearch |
| Joli Table Of Contents | joli-table-of-contents |
| Kalles Addons | kalles-addons |
| King Addons for Elementor – 80+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce, Mega Menu, Popup Builder | king-addons |
| Kirki – Freeform Page Builder, Website Builder & Customizer | kirki |
| KP Agent Ready | kp-agent-ready |
| LearnDash LMS | sfwd-lms |
| LearnPress – WordPress LMS Plugin for Create and Sell Online Courses | learnpress |
| Listdom: AI-powered Business Directory with Classifieds Ads Listings | listdom |
| LiteSpeed Cache | litespeed-cache |
| Live Composer – Free WordPress Website Builder | live-composer-page-builder |
| Login With Ajax – Fast Logins, 2FA, Redirects | login-with-ajax |
| Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance | mail-mint |
| MalCare WordPress Security Plugin – Malware Scanner, Cleaner, Security Firewall | malcare-security |
| Mang Board WP | mangboard |
| MapGeo – Interactive Geo Maps | interactive-geo-maps |
| MapSVG – Vector maps, Image maps, Google Maps | mapsvg-lite-interactive-vector-maps |
| MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution | marketking-multivendor-marketplace-for-woocommerce |
| Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits | master-addons |
| Masteriyo LMS – LMS Course Builder, Quizzes & Certificates | learning-management-system |
| MasterStudy LMS WordPress Plugin – for Online Courses and Education | masterstudy-lms-learning-management-system |
| MemberDash | memberdash |
| MemberHero – Simple User Registration & Login | wp-registration |
| Migrate Guru – Site Migration & Cloning | migrate-guru |
| MotoPress Appointment Booking | motopress-appointment-lite |
| MountDev AI MCP Connector for WordPress | mountdev-ai-mcp-connector |
| MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar | mp3-music-player-by-sonaar |
| MStore API – Create Native Android & iOS Apps On The Cloud | mstore-api |
| MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions | dc-woocommerce-multi-vendor |
| My Private Site – Make Your Whole Site Private, Force Login & Block Registration Spam | jonradio-private-site |
| Ninja Forms - File Uploads | ninja-forms-uploads |
| Ninja Forms - Layout & Styles | ninja-forms-style |
| Ninja Forms - Save Progress | ninja-forms-save-progress |
| Ninja Forms - Scheduled Exports | ninja-forms-scheduled-exports |
| Ninja Forms – The Contact Form Builder That Grows With You | ninja-forms |
| Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE | otter-blocks |
| Oxygen | oxygen |
| Persistent Login | wp-persistent-login |
| Photo Gallery by 10Web – Mobile-Friendly Image Gallery | photo-gallery |
| Photo Gallery by Ays – Responsive Image Gallery | gallery-photo-gallery |
| Pods – Custom Content Types and Fields | pods |
| Post Grid | post-grid |
| Powerkit – Supercharge your WordPress Site | powerkit |
| Pre-Orders for WooCommerce | pre-orders-for-woocommerce |
| Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce | a4-barcode-generator |
| Product Attachment for WooCommerce | woo-product-attachment |
| Product Variations Swatches for WooCommerce | product-variations-swatches-for-woocommerce |
| PublishPress Permissions: Access Control, Content Permissions, User Access | press-permit-core |
| Quick Event Manager | quick-event-manager |
| QuickCal | quickcal |
| Rank Math SEO – AI SEO Tools to Dominate SEO Rankings | seo-by-rank-math |
| Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) | really-simple-ssl |
| Redirection for Contact Form 7 | wpcf7-redirect |
| RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login | custom-registration-form-builder-with-submission-manager |
| RentSyst – CRM solution for fleet management | rentsyst |
| Rest Routes – Custom Endpoints for WordPress REST API | rest-routes |
| Restaurant Menu and Food Ordering | mp-restaurant-menu |
| RTMKit | rometheme-for-elementor |
| Search Atlas SEO – OTTO AI SEO Automation for WordPress | metasync |
| SEOPress – AI SEO Plugin & On-site SEO | wp-seopress |
| Shared Files Pro | shared-files-pro |
| Shopping Cart & eCommerce Store | wp-easycart |
| SigmaForms Pro – AI Generated Forms | sigmaforms-pro |
| Simple Ajax Chat – Add a Fast, Secure Chat Box | simple-ajax-chat |
| Simple Membership | simple-membership |
| Simple Payment | simple-payment |
| Simply Schedule Appointments | simply-schedule-appointments |
| Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News | post-carousel |
| SmartyParcel – Multi-Carrier Shipping, Order Tracking & Live Rates for WooCommerce | wc-ukr-shipping |
| Social Chat – Click To Chat App Button | wp-whatsapp-chat |
| Social Media Share Buttons & Social Sharing Icons | ultimate-social-media-icons |
| Solace Extra | solace-extra |
| Spam protection, Honeypot, Anti-Spam by CleanTalk | cleantalk-spam-protect |
| Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System | support-genix-lite |
| SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz | sureforms |
| The Events Calendar | the-events-calendar |
| Theme My Login | theme-my-login |
| Timetics – Appointment Booking Calendar & Scheduling | timetics |
| Total processing card payments for WooCommerce | [Article truncated — read full content at source]
Source Attribution
This intelligence summary is sourced from Wordfence Blog and curated by CyberHawk Threat Intel for the security community. Full article content is displayed with attribution under fair use for security research and education. Read original at Wordfence Blog → Accelerate Your Security OperationsCyberHawk Threat Intel is a complete Cyber Intelligence Platform — one place for every tool a security professional needs. Built by Rudra Verma, Senior Security Architect and Researcher, CyberHawk Consultancy. IOC Scanner — scan any domain, IP, hash, URL
Live IOC Feed — 3.6M+ indicators, filterable
Infostealer Intelligence — live compromised creds
Live Threat Map — real-time global attack vectors
MISP Threat Feeds — CIRCL, Feodo, Botvrij, more
GitHub Arsenal — curated security tools and scripts
Security Blog — CVE advisories and threat research
Video Courses — cybersecurity training and education
SOPs and Playbooks — SecOps procedures
Analyst Library — references and toolkits
Scan Reports — historical threat intelligence
Cyber News — this feed, aggregated in-platform
|