Last week, there were 224 vulnerabilities disclosed in 177 WordPress Plugins and 2 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 119 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.
Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back.
Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 35,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
New Firewall Rules Deployed Last Week
The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.
The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:
- WPMU DEV Dashboard <= 5.0.0 – Authentication Bypass to Arbitrary Plugin Installation (Remote Code Execution) via Forged WDP_AUTH HMAC on ?wpmudev-hub= Endpoint
- Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … 10.8.7 – Unauthenticated Authentication Bypass via Hardcoded Backdoor in ‘_wplogin’ Parameter
- WAF-RULE-935 – Data redacted while we work with the vendor on a patch.
- WAF-RULE-937 – Data redacted while we work with the vendor on a patch.
Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.
Total Unpatched & Patched Vulnerabilities Last Week
| Patch Status | Number of Vulnerabilities |
|---|---|
| Patched | 186 |
| Unpatched | 38 |
Total Vulnerabilities by CVSS Severity Last Week
| Severity Rating | Number of Vulnerabilities |
|---|---|
| Medium Severity | 150 |
| High Severity | 61 |
| Critical Severity | 13 |
Total Vulnerabilities by CWE Type Last Week
| Vulnerability Type by CWE | Number of Vulnerabilities |
|---|---|
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 72 |
| Missing Authorization | 47 |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 31 |
| Exposure of Sensitive Information to an Unauthorized Actor | 14 |
| Authorization Bypass Through User-Controlled Key | 12 |
| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 10 |
| Cross-Site Request Forgery (CSRF) | 7 |
| Server-Side Request Forgery (SSRF) | 6 |
| Improper Privilege Management | 5 |
| Unrestricted Upload of File with Dangerous Type | 5 |
| Improper Control of Generation of Code ('Code Injection') | 4 |
| Deserialization of Untrusted Data | 3 |
| Authentication Bypass by Alternate Name | 1 |
| Authentication Bypass Using an Alternate Path or Channel | 1 |
| Embedded Malicious Code | 1 |
| External Control of Assumed-Immutable Web Parameter | 1 |
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | 1 |
| Incorrect Authorization | 1 |
| Incorrect Privilege Assignment | 1 |
| Unverified Password Change | 1 |
Researchers That Contributed to WordPress Security Last Week
| Researcher Name | Number of Vulnerabilities |
|---|---|
| 49 | |
| 26 | |
| 11 | |
| 4 | |
| 4 | |
| 4 | |
| 4 | |
| 3 | |
| 3 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.
WordPress Plugins with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| Ad Invalid Click Protector (AICP) | ad-invalid-click-protector |
| Admin and Site Enhancements (ASE) Pro | admin-site-enhancements-pro |
| Advanced Form Integration — Connect Forms to 200+ Apps | advanced-form-integration |
| Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … | advanced-responsive-video-embedder |
| Advanced Shipment Tracking for WooCommerce | woo-advanced-shipment-tracking |
| Advanced Views – Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… | acf-views |
| Advanced Woo Labels – Product Labels & Badges for WooCommerce | advanced-woo-labels |
| AffiliateWP | affiliate-wp |
| AI Copilot – Content Generator | ai-copilot-content-generator |
| AI Engine – The Chatbot, AI Framework & MCP for WordPress | ai-engine |
| Animation Addons for Elementor – GSAP Motion Elementor Addons & Website Templates | animation-addons-for-elementor |
| AnsPress – Question and answer | anspress-question-answer |
| Anti Spam and list cleaner – AcyChecker | acychecker |
| Auto Featured Image (Auto Post Thumbnail) | auto-post-thumbnail |
| BackWPup – WordPress Backup & Restore Plugin | backwpup |
| Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots | bp-better-messages |
| Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder | bit-form |
| Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation | bit-integrations |
| Booking Calendar | booking |
| Booking System Trafft | booking-system-trafft |
| BOX NOW Delivery Croatia + Slovenia | box-now-delivery-croatia |
| Breakdance | breakdance |
| BuddyPress | buddypress |
| Business Directory Plugin – Easy Listing Directories for WordPress | business-directory-plugin |
| Chaty Pro | chaty-pro |
| Checkout Field Editor for WooCommerce – Checkout Manager | checkout-field-editor-and-manager-for-woocommerce |
| Colissimo shipping methods for WooCommerce | colissimo-shipping-methods-for-woocommerce |
| Contact Form to Any API | contact-form-to-any-api |
| Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe | contest-gallery |
| Cost Calculator Builder PRO | cost-calculator-builder-pro |
| Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates | cozy-addons |
| Creative Mail – Easier WordPress & WooCommerce Email Marketing | creative-mail-by-constant-contact |
| CubeWP Framework | cubewp-framework |
| Database Collation Fix | database-collation-fix |
| Database for CF7 | database-for-cf7 |
| Demi – One Click Demo Import, Backup & Site Migration | demi-backup-migration |
| Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy | dokan-lite |
| Download Manager | download-manager |
| Easy Appointments | easy-appointments |
| Easy Digital Downloads – eCommerce Payments and Subscriptions made easy | easy-digital-downloads |
| Easy PayPal & Stripe Buy Now Button | wp-ecommerce-paypal |
| Easy Property Listings | easy-property-listings |
| Eazy Plugin Manager – Powerful Plugin Management Solution for WordPress | plugins-on-steroids |
| Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons | bdthemes-element-pack-lite |
| Essential Addons for Elementor – Popular Elementor Templates & Widgets | essential-addons-for-elementor-lite |
| Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar | mage-eventpress |
| Exclusive Addons for Elementor | exclusive-addons-for-elementor |
| Export User Data | export-user-data |
| Extra Checkout Options - addon for Extra Product Options plugin | woocommerce-tm-extra-checkout-options-addon |
| Facturación Electrónica Costa Rica | factura-electronica-cr |
| FleekDash V2 | fleekdash |
| Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder | fluentform |
| FormCraft | formcraft |
| FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More | formgent |
| Formidable Forms Signature Online Contract Automation | forms-signature-formidable-online-contract-automation |
| FundEngine – Donation and Crowdfunding Platform | wp-fundraising-donation |
| FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) | fusewp |
| Gallery PhotoBlocks | photoblocks-grid-gallery |
| GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress | gamipress |
| GenerateBlocks | generateblocks |
| GEO Plugin by Squirrly SEO | squirrly-seo |
| GetGenie – AI SEO Assistant & Content Writer with Keyword Research, AEO & GEO | getgenie |
| GiveWP – Donation Plugin and Fundraising Platform | give |
| GSheetConnector – Contact Form 7 Google Sheets Connector & Save CF7 Entries to Database | cf7-google-sheets-connector |
| GTM4WP – A Google Tag Manager (GTM) plugin for WordPress | duracelltomi-google-tag-manager |
| Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder | gutena-forms |
| HBook - Hotel booking system - WordPress Plugin | hbook |
| Icegram Engage – Popups, Optins, CTAs & Lead Generation | icegram |
| Icegram Mailer – Reliable Email Deliverability, No-code SMTP Replacement & Email logs | icegram-mailer |
| Improved Save Button | improved-save-button |
| Insert Headers and Footers Code – HT Script | insert-headers-and-footers-script |
| Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress | jeg-elementor-kit |
| JetBlocks for Elementor | jet-blocks |
| JetReviews | jet-reviews |
| JetSearch | jet-search |
| Kadence Blocks — Page Builder Toolkit for Gutenberg Editor | kadence-blocks |
| Kali Forms — Contact Form & Drag-and-Drop Builder | kali-forms |
| Kirki – Freeform Page Builder, Website Builder & Customizer | kirki |
| Klubraum Membership Request | klubraum-membership-request |
| LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes | lifterlms |
| Link Library | link-library |
| Location Weather – WordPress Weather Forecast, Air Quality & Weather Widget | location-weather |
| MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder | mailchimp-subscribe-sm |
| MailerPress – Email Marketing, Newsletter, Email Automation & WooCommerce Emails | mailerpress |
| MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. | mailoptin |
| MasterStudy LMS WordPress Plugin – for Online Courses and Education | masterstudy-lms-learning-management-system |
| Media Cleaner: Clean your WordPress! | media-cleaner |
| Message Filter for Contact Form 7 | cf7-message-filter |
| Meta Box AIO | meta-box-aio |
| Meta for WooCommerce | facebook-for-woocommerce |
| Meta pixel for WordPress | official-facebook-pixel |
| miniOrange OTP Login, Verification and SMS Notifications | miniorange-otp-verification |
| Newsletters | newsletters-lite |
| NEX-Forms – Ultimate Forms Plugin for WordPress | nex-forms-express-wp-form-builder |
| Online Scheduling and Appointment Booking System – Bookly | bookly-responsive-appointment-booking-tool |
| Open User Map – Interactive Leaflet Maps | open-user-map |
| Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions | paid-memberships-pro |
| Payment forms, Buy now buttons, and Invoicing System | GetPaid | invoicing |
| PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer | pdfdraft |
| Photonic Gallery & Lightbox for Flickr, SmugMug & Others | photonic |
| PickPlugins Question Answer | question-answer |
| Pinpoint Booking System – Version 2 | booking-system |
| PixelYourSite Pro – Your smart PIXEL (TAG) Manager | pixelyoursite-pro |
| PixelYourSite – Your smart PIXEL (TAG) & API Manager | pixelyoursite |
| Plugin Organizer | plugin-organizer |
| Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred | mycred |
| Powerkit – Supercharge your WordPress Site | powerkit |
| Premium Packages – Sell Digital Products Securely | wpdm-premium-packages |
| Pronamic Pay | pronamic-ideal |
| Qode Tours | qode-tours |
| Rank Math SEO – AI SEO Tools to Dominate SEO Rankings | seo-by-rank-math |
| RealHomes Memberships | inspiry-memberships |
| Realtyna Organic IDX plugin + WPL Real Estate | real-estate-listing-realtyna-wpl |
| RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login | custom-registration-form-builder-with-submission-manager |
| Responsive Thumbnail Slider | wp-responsive-thumbnail-slider |
| RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator | feedzy-rss-feeds |
| RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg | rt-mega-menu |
| Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization | metasync |
| SendPulse Email Marketing Newsletter | sendpulse-email-marketing-newsletter |
| ShopLentor Pro | woolentor-addons-pro |
| ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin | woolentor-addons |
| Shortcodify | shortcodify |
| Simple Link Directory Pro - AI Powered | simple-link-directory-pro |
| Simply Schedule Appointments | simply-schedule-appointments |
| Single Sign On For TNG | single-sign-on-for-tng |
| SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery | sms-alert |
| Social Share, Social Login and Social Comments Plugin – Super Socializer | super-socializer |
| Spam protection, Honeypot, Anti-Spam by CleanTalk | cleantalk-spam-protect |
| SpeedyCache – Cache, Optimization, Performance | speedycache |
| Spider Analyser – WordPress搜索引擎蜘蛛分析插件 | spider-analyser |
| Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light | excel-like-price-change-for-woocommerce-and-wp-e-commerce-light |
| Staff Training | staff-training |
| StoreGrowth – Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce | storegrowth-sales-booster |
| Subscriptions for WooCommerce | subscriptions-for-woocommerce |
| SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz | sureforms |
| Survey Form Block – collect answers and insights from your audience | survey-form-block |
| Sync Post With Other Site | sync-post-with-other-site |
| Taskbuilder – Project Management & Task Management Tool With Kanban Board | taskbuilder |
| Theme Editor | theme-editor |
| Thrive Leads | thrive-leads |
| TrueBooker – Appointment Booking and Scheduler System | truebooker-appointment-booking |
| Tutor LMS – eLearning and online course solution | tutor |
| Ultimate Addons for Elementor | ultimate-elementor |
| Ultimate Store Kit – Addon For WooCommerce, EDD and Elementor | ultimate-store-kit |
| Ultra Addons for Contact Form 7 | ultimate-addons-for-contact-form-7 |
| Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin | uncanny-automator |
| User Access Manager | user-access-manager |
| User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor | profile-builder |
| User Profile Picture | metronet-profile-picture |
| Vimeo | vimeo |
| W3 Total Cache | w3-total-cache |
| Web Directory Free | web-directory-free |
| Wholesale for WooCommerce | woo-wholesale-pricing |
| WooCommerce - Social Login | woo-social-login |
| WooCommerce PayPal Payments | woocommerce-paypal-payments |
| WowStore – Store Builder & Product Blocks for WooCommerce | product-blocks |
| WP CTA – Call Now Button, Sticky Button & Call to Action Builder | easy-sticky-sidebar |
| WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) | delicious-recipes |
| WP Fast Total Search – The Power of Indexed Search | fulltext-search |
| WP Google Review Slider | wp-google-places-review-slider |
| WP Hotel Booking | wp-hotel-booking |
| WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters | wp-google-map-plugin |
| WP OAuth Server ( Login with WordPress ) | miniorange-oauth-20-server |
| WP Password Policy | password-requirements |
| WP Photo Album Plus | wp-photo-album-plus |
| WP Travel – Ultimate Travel Booking System, Tour Management Engine | wp-travel |
| WP-Lister Lite for eBay | wp-lister-for-ebay |
| WPBot – AI ChatBot for Live Support, Lead Generation, AI Services | chatbot |
| WPC Badge Management for WooCommerce | wpc-badge-management |
| wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin | wpdatatables |
| WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode | gdpr-cookie-consent |
| WPML Multilingual & Multicurrency for WooCommerce | woocommerce-multilingual |
| WPvivid — Backup, Migration & Staging | wpvivid-backuprestore |
| Xendit Payment | woo-xendit-virtual-accounts |
| YayPricing – WooCommerce Dynamic Pricing & Discounts | yaypricing |
| ЮKassa для WooCommerce | yookassa |
| المنتور فارسی | persian-elementor |
WordPress Themes with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| Betheme | betheme |
| Gillion | Multi-Concept Blog/Magazine & Shop WordPress AMP Theme | gillion |
Vulnerability Details
Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.
Affected Software
Admin and Site Enhancements (ASE) Pro [admin-site-enhancements-pro]
Researcher
Affected Software
Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … [advanced-responsive-video-embedder]
Researcher
Affected Software
AI Copilot – Content Generator [ai-copilot-content-generator]
Researcher