Last week, there were 223 vulnerabilities disclosed in 175 WordPress Plugins and 6 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 88 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.
Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back.
Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 35,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
New Firewall Rules Deployed Last Week
The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.
The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:
Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.
Total Unpatched & Patched Vulnerabilities Last Week
| Patch Status | Number of Vulnerabilities |
|---|---|
| Patched | 155 |
| Unpatched | 68 |
Total Vulnerabilities by CVSS Severity Last Week
| Severity Rating | Number of Vulnerabilities |
|---|---|
| Medium Severity | 172 |
| High Severity | 42 |
| Critical Severity | 9 |
Total Vulnerabilities by CWE Type Last Week
| Vulnerability Type by CWE | Number of Vulnerabilities |
|---|---|
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 70 |
| Missing Authorization | 59 |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 25 |
| Exposure of Sensitive Information to an Unauthorized Actor | 13 |
| Cross-Site Request Forgery (CSRF) | 11 |
| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 8 |
| Server-Side Request Forgery (SSRF) | 7 |
| Unrestricted Upload of File with Dangerous Type | 5 |
| Authorization Bypass Through User-Controlled Key | 4 |
| Deserialization of Untrusted Data | 4 |
| Improper Authentication | 3 |
| Improper Control of Generation of Code ('Code Injection') | 3 |
| Improper Privilege Management | 3 |
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | 2 |
| Improper Input Validation | 2 |
| Incorrect Privilege Assignment | 2 |
| Incorrect Authorization | 1 |
| Relative Path Traversal | 1 |
Researchers That Contributed to WordPress Security Last Week
| Researcher Name | Number of Vulnerabilities |
|---|---|
| 49 | |
| 28 | |
| 6 | |
| 6 | |
| 6 | |
| 5 | |
| 5 | |
| 4 | |
| 4 | |
| 4 | |
| 4 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.
WordPress Plugins with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| Abandoned Cart Lite for WooCommerce | woocommerce-abandoned-cart |
| Accept Donations with PayPal & Stripe | easy-paypal-donation |
| Advanced Views – Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… | acf-views |
| AffiliateWP | affiliate-wp |
| AffiliateX – Amazon Affiliate Plugin, Product Boxes, Comparison Tables & Affiliate Link Tracking | affiliatex |
| AI Copilot – Content Generator | ai-copilot-content-generator |
| Appointment Hour Booking – Booking Calendar | appointment-hour-booking |
| ARforms | arforms |
| Avada Core | fusion-core |
| Avada Custom Branding | fusion-white-label-branding |
| AWP Classifieds | another-wordpress-classifieds-plugin |
| BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot | betterdocs |
| Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment | booking-and-rental-manager-for-woocommerce |
| Brands for WooCommerce | brands-for-woocommerce |
| Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP | videowhisper-live-streaming-integration |
| BSK PDF Manager | bsk-pdf-manager |
| Bulk Page Generator – LPagery | lpagery |
| Byteflows Travel & Hotel Booking | byteflows-travel-hotel-booking |
| Checkout Field Editor for WooCommerce (Pro) | woocommerce-checkout-field-editor-pro |
| Civi Framework | civi-framework |
| CoCart – Headless REST API for WooCommerce | cart-rest-api-for-woocommerce |
| Complianz – GDPR/CCPA Cookie Consent | complianz-gdpr |
| Contact Form 7 – Dynamic Text Extension | contact-form-7-dynamic-text-extension |
| Content Control – The Ultimate Content Restriction Plugin! Restrict Content, Create Conditional Blocks & More | content-control |
| Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates | cozy-addons |
| Create | mediavine-create |
| Custom links in Elementor Image Carousel | custom-links-in-elementor-image-carousel |
| Customer Support Ticket System & Helpdesk | wp-ticket |
| Cyr to Lat Reloaded – Transliteration of Links and File Names | cyr-and-lat |
| Directory Listings WordPress plugin – uListing | ulisting |
| Ditty – Responsive News Tickers, Sliders, and Lists | ditty-news-ticker |
| Dokan Pro | dokan-pro |
| Dynamic Pricing With Discount Rules for WooCommerce | aco-woo-dynamic-pricing |
| Easy Appointments | easy-appointments |
| Easy Digital Downloads – eCommerce Payments and Subscriptions made easy | easy-digital-downloads |
| Easy Form Builder by WhiteStudio – Drag & Drop Form Builder | easy-form-builder |
| Ebook Store | ebook-store |
| Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance | accessibility-checker |
| eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams | eroom-zoom-meetings-webinar |
| Essential Addons for Elementor – Popular Elementor Templates & Widgets | essential-addons-for-elementor-lite |
| Event Post | event-post |
| Event Tickets and Registration | event-tickets |
| EventON Action User | eventon-action-user |
| Events Made Easy | events-made-easy |
| Falcon – WordPress Optimizations & Tweaks | falcon |
| Firelight Lightbox | easy-fancybox |
| Flipbook PDF Viewer & Embedder | pdf-embed-viewer |
| Fluent Forms Pro Add On Pack | fluentformpro |
| Fluent Support – Helpdesk & Customer Support Ticket System | fluent-support |
| FormCraft | formcraft3 |
| GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress | gamipress |
| GiveWP – Donation Plugin and Fundraising Platform | give |
| GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more | godam |
| Graphina – Charts and Graphs For Elementor | graphina-elementor-charts-and-graphs |
| Grid/List View for WooCommerce | gridlist-view-for-woocommerce |
| GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor | gutenkit-blocks-addon |
| HashThemes Demo Importer | hashthemes-demo-importer |
| Header Footer Script Adder | header-and-footer-script-adder |
| Hubbub Lite – Fast, free social sharing and follow buttons | social-pug |
| JetBooking | jet-booking |
| JetElements | jet-elements |
| JetEngine | jet-engine |
| Kali Forms — Contact Form & Drag-and-Drop Builder | kali-forms |
| Kirki – Freeform Page Builder, Website Builder & Customizer | kirki |
| Kit (formerly ConvertKit) – Email Newsletter, Email Marketing, Membership, Subscribers and Landing Pages | convertkit |
| Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more | knit-pay |
| Kwayy HTML Sitemap | kwayy-html-sitemap |
| LA-Studio Element Kit for Elementor | lastudio-element-kit |
| License Manager for WooCommerce | license-manager-for-woocommerce |
| LIQUID SPEECH BALLOON | liquid-speech-balloon |
| ListingPro Plugin | listingpro-plugin |
| Machete | machete |
| MailPoet – Newsletters, Email Marketing, and Automation | mailpoet |
| Mailster WordPress Newsletter Plugin | mailster |
| MapPress – Google Maps, OpenStreetMap & Leaflet | mappress-google-maps-for-wordpress |
| MapSVG | mapsvg |
| MapSVG – Vector maps, Image maps, Google Maps | mapsvg-lite-interactive-vector-maps |
| MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution | marketking-multivendor-marketplace-for-woocommerce |
| Masteriyo LMS – LMS Course Builder, Quizzes & Certificates | learning-management-system |
| MDJM Event Management | mobile-dj-manager |
| Mediavine Control Panel | mediavine-control-panel |
| miniOrange Discord Integration | miniorange-discord-integration |
| miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon | miniorange-login-openid |
| Modula Image Gallery – Photo Grid & Video Gallery | modula-best-grid-gallery |
| MountDev AI MCP Connector for WordPress | mountdev-ai-mcp-connector |
| MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar | mp3-music-player-by-sonaar |
| Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder | the-plus-addons-for-block-editor |
| Ninja Forms – The Contact Form Builder That Grows With You | ninja-forms |
| Ninja Tables – Easy Data Table Builder | ninja-tables |
| Open User Map – Interactive Leaflet Maps | open-user-map |
| Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More | themeisle-companion |
| Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction | paid-member-subscriptions |
| Participants Database | participants-database |
| Payment Gateway for PayPal on WooCommerce | woo-paypal-gateway |
| Payment Plugins for Stripe WooCommerce | woo-stripe-payment |
| PayU India | payu-india |
| PeproDev Ultimate Invoice | pepro-ultimate-invoice |
| Photo Block – A Modern Image Block With Lightbox and Caption Support | photo-block |
| Photo Gallery – GT3 Image Gallery & Gutenberg Block Gallery | gt3-photo-video-gallery |
| Photo Gallery – Responsive Image Galleries by Supsystic | gallery-by-supsystic |
| Picture Gallery – Frontend Image Uploads, AJAX Photo List | picture-gallery |
| PiWeb Product Enquiry or product catalog for WooCommerce | enquiry-quotation-for-woocommerce |
| Polylang | polylang |
| Popup for CF7 with Sweet Alert | cf7-sweet-alert-popup |
| Post Grid Gutenberg Blocks – PostX | ultimate-post |
| Post My CF7 Form | post-my-contact-form-7 |
| Premium Packages – Sell Digital Products Securely | wpdm-premium-packages |
| Product Designer for WooCommerce WordPress | Lumise | lumise |
| Product Feed Manager For WooCommerce – Sell on 200+ Online Marketplaces | best-woocommerce-feed |
| Product Slider, Product Grid, Product Masonry | woocommerce-products-slider |
| Qubely – Advanced Gutenberg Blocks | qubely |
| Query Wrangler | query-wrangler |
| QuickCal | quickcal |
| Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker | quiz-master-next |
| Real Estate Manager Pro | real-estate-manager-pro |
| Really Simple CSV Importer | really-simple-csv-importer |
| Registrations for the Events Calendar – Event Registration Plugin | registrations-for-the-events-calendar |
| Relevanssi Light | relevanssi-light |
| reviewer | reviewer |
| Rich Showcase for Google Reviews | widget-google-reviews |
| rtMedia for WordPress, BuddyPress and bbPress | buddypress-media |
| SAML Single Sign On – SSO Login | miniorange-saml-20-single-sign-on |
| Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce | sender-net-automated-emails |
| Shiptastic for WooCommerce | shiptastic-for-woocommerce |
| ShipTime: Discount Shipping | shiptime-discount-shipping |
| Slider Pro | sliderpro |
| Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management | smart-manager-for-wp-e-commerce |
| Smart SEO Tool – SEO优化插件 | smart-seo-tool |
| SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery | sms-alert |
| Spectra Legacy – Gutenberg Blocks | ultimate-addons-for-gutenberg |
| Style Kits for Elementor | analogwp-templates |
| SUMO Reward Points for WooCommerce | rewardsystem |
| Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers | sunshine-photo-cart |
| SureDash – Community, Courses & Member Dashboard | suredash |
| Tabs Responsive – With WooCommerce Product Tabs Extension | tabs-responsive |
| TemplateSpare – 1000+ WordPress Starter Templates & Full Site Migration Tool | 1-Click Import/Export & No-Code Builder | templatespare |
| Thrive Quiz Builder | thrive-quiz-builder |
| Thrive Themes – Product Manager | thrive-product-manager |
| Tickera – Sell Tickets & Manage Events | tickera-event-ticketing-system |
| TinyMCE Templates | tinymce-templates |
| Tonda Core | tonda-core |
| Tutor LMS Elementor Addons | tutor-lms-elementor-addons |
| Ultimate Addons for Elementor | header-footer-elementor |
| Ultimate Store Kit – Addon For WooCommerce, EDD and Elementor | ultimate-store-kit |
| Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin | uncanny-automator |
| Video Player for YouTube – embed videos your visitors will love to watch | yt-player |
| VikBooking Hotel Booking Engine & PMS | vikbooking |
| Virtue/Ascend/Pinnacle Toolkit | virtue-toolkit |
| Visual Composer Website Builder | visualcomposer |
| Visualizer – Tables & Charts Manager with Built-in AI Generator | visualizer |
| WCPOS – Point of Sale (POS) plugin for WooCommerce | woocommerce-pos |
| Web Push Notifications – Webpushr | webpushr-web-push-notifications |
| WP Accessibility Helper (WAH) | wp-accessibility-helper |
| WP Activity Log | wp-security-audit-log |
| WP BASE Booking of Appointments, Services and Events | wp-base-booking-of-appointments-services-and-events |
| WP Easy Pay – Payment and Donation Form Builder for Square | wp-easy-pay |
| WP Encryption – Lifetime Free SSL Cert & HTTPS, Force SSL / HTTPS Redirect, SSL Security | wp-letsencrypt-ssl |
| WP Fast Total Search – The Power of Indexed Search | fulltext-search |
| WP Foodbakery | wp-foodbakery |
| WP Ghost (Hide My WP Ghost) – Security & Firewall | hide-my-wp |
| WP Go Maps – Google Map, OpenStreetMap, Leaflet Map | wp-google-maps |
| WP Hotel Booking | wp-hotel-booking |
| WP Shortcode by MyThemeShop | wp-shortcode |
| WP Social Ninja – Embed Social Feeds, User Reviews & Chat Widgets | wp-social-reviews |
| WP-Polls | wp-polls |
| WPForms Pro | wpforms |
| WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More | wpforms-lite |
| WPify Woo – Withdrawal, CRN/VAT, QR payments, Heureka and more for WooCommerce | wpify-woo |
| WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) | wpo365-login |
| Yoast SEO – Advanced SEO with real-time guidance and built-in AI | wordpress-seo |
| Ziina | ziina |
| ЮKassa для WooCommerce | yookassa |
| افزونه حمل و نقل ووکامرس | پست پیشتاز، تیپاکس و پیک موتوری | persian-woocommerce-shipping |
| افزونه پرداخت امن زرینپال برای ووکامرس (ZarinPal for WooCommerce) | zarinpal-woocommerce-payment-gateway |
| افزونه پیامک ووکامرس Persian WooCommerce SMS | persian-woocommerce-sms |
WordPress Themes with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| Civi - Job Board & Freelance Marketplace WordPress Theme | civi |
| Grand Photography WordPress | grandphotography |
| Manual - Documentation, Knowledge Base & Education WordPress Theme | manual |
| photography | photography |
| TheGem | thegem |
| Vino - A Refined Winery, Wine Bar and Vineyard WordPress Theme | vino |
Vulnerability Details
Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.
Affected Software
Customer Support Ticket System & Helpdesk [wp-ticket]
Researcher
Affected Software
Easy Form Builder by WhiteStudio – Drag & Drop Form Builder [easy-form-builder]
Researcher
Affected Software
Researcher
Affected Software
MountDev AI MCP Connector for WordPress [mountdev-ai-mcp-connector]
Researcher
Affected Software
SAML Single Sign On – SSO Login [miniorange-saml-20-single-sign-on]
Researcher
Affected Software
Researcher
Affected Software
WP BASE Booking of Appointments, Services and Events [wp-base-booking-of-appointments-services-and-events]
Researcher
Affected Software
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP [videowhisper-live-streaming-integration]
Researcher
Affected Software
Participants Database [participants-database]
Researcher
Affected Software
Fluent Forms Pro Add On Pack [fluentformpro]
Researcher
Affected Software
MDJM Event Management [mobile-dj-manager]
Researcher
Source Attribution
This intelligence summary is sourced from Wordfence Blog and curated by CyberHawk Threat Intel for the security community. Full article content is displayed with attribution under fair use for security research and education.
Read original at Wordfence Blog →
This intelligence summary is sourced from Wordfence Blog and curated by CyberHawk Threat Intel for the security community. Full article content is displayed with attribution under fair use for security research and education.
Read original at Wordfence Blog →
Accelerate Your Security Operations
CyberHawk Threat Intel is a complete Cyber Intelligence Platform — one place for every tool a security professional needs. Built by Rudra Verma, Senior Security Architect and Researcher, CyberHawk Consultancy.
IOC Scanner — scan any domain, IP, hash, URL
Live IOC Feed — 3.6M+ indicators, filterable
Infostealer Intelligence — live compromised creds
Live Threat Map — real-time global attack vectors
MISP Threat Feeds — CIRCL, Feodo, Botvrij, more
GitHub Arsenal — curated security tools and scripts
Security Blog — CVE advisories and threat research
Video Courses — cybersecurity training and education
SOPs and Playbooks — SecOps procedures
Analyst Library — references and toolkits
Scan Reports — historical threat intelligence
Cyber News — this feed, aggregated in-platform