Last week, there were 319 vulnerabilities disclosed in 222 WordPress Plugins that have been added to the Wordfence Intelligence Vulnerability Database, and there were 156 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, and webhook integration are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back.

Enterprises, Hosting Providers, and even Individuals can utilize the vulnerability Database API to receive a complete dump of our database of over 40,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

New Firewall Rules Deployed Last Week

The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.

The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:

Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.

Total Unpatched & Patched Vulnerabilities Last Week

Patch Status Number of Vulnerabilities
Patched 305
Unpatched 14

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating Number of Vulnerabilities
Medium Severity 226
High Severity 79
Critical Severity 14

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE Number of Vulnerabilities
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') 96
Missing Authorization 59
Authorization Bypass Through User-Controlled Key 26
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') 24
Exposure of Sensitive Information to an Unauthorized Actor 22
Improper Privilege Management 14
Deserialization of Untrusted Data 11
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') 11
Improper Control of Generation of Code ('Code Injection') 8
Client-Side Enforcement of Server-Side Security 7
Server-Side Request Forgery (SSRF) 7
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') 5
Incorrect Authorization 5
Cross-Site Request Forgery (CSRF) 4
Improper Authentication 4
Improper Authorization 3
Protection Mechanism Failure 3
Uncontrolled Resource Consumption 3
Guessable CAPTCHA 2
Unrestricted Upload of File with Dangerous Type 2
Improper Input Validation 1
Incorrect Privilege Assignment 1
Origin Validation Error 1

Researchers That Contributed to WordPress Security Last Week

Researcher Name Number of Vulnerabilities
34
11
11
8
8
8
8
8
7
6
6
6
5
5
5
4
4
4
4
4
4
3
3
3
3
3
3
3
3
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
1
1
1
UKO
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
Bee
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
dcs
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name Software Slug
10Web Booster – Website speed optimization, Cache & Page Speed optimizer tenweb-speed-optimizer
Ad Inserter – Ad Manager & AdSense Ads ad-inserter
Admin Notices Manager admin-notices-manager
Advanced Contact form 7 DB advanced-cf7-db
AI Engine – The Chatbot, AI Framework & MCP for WordPress ai-engine
All-In-One Security (AIOS) – Security and Firewall all-in-one-wp-security-and-firewall
AMP for WP – Accelerated Mobile Pages accelerated-mobile-pages
AppMySite – WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker) appmysite
Appointment Booking Plugin & Scheduling System – Webba Booking Calendar webba-booking-lite
Asset CleanUp: Page Speed Booster wp-asset-clean-up
Automatic.css automatic-css
Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code automation-web-platform
BA Book Everything ba-book-everything
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots bp-better-messages
Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More better-payment
Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification wc-blacklist-manager
Blocksy Companion blocksy-companion
Blog2Social: Social Media Auto Post & Scheduler blog2social
Bluff Post bluff-post
BM Content Builder bm-builder
Booking Calendar booking
Booking Manager – Sync WP Booking Calendar – Import Events, Export Bookings to ICS Calendar booking-manager
Business Directory Plugin – Easy Listing & Member Directories for WordPress business-directory-plugin
Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More calculated-fields-form
Captcha Code captcha-code-authentication
CartFlows – Funnel Builder & Checkout Plugin for WooCommerce cartflows
CMB2 cmb2
CMP – Coming Soon & Maintenance Plugin by NiteoThemes cmp-coming-soon-maintenance
Conekta Payment Gateway conekta-payment-gateway
Contextual Related Posts contextual-related-posts
Core Web Vitals & PageSpeed Booster core-web-vitals-pagespeed-booster
CSS & JavaScript Toolbox css-javascript-toolbox
Custom Field Template custom-field-template
Custom Thank You Page for WooCommerce custom-thank-you-page
Customer Reviews for WooCommerce customer-reviews-woocommerce
Directorist: AI-Powered Business Directory, Listings & Classified Ads directorist
Ditty – Responsive News Tickers, Sliders, and Lists ditty-news-ticker
Divi Dash divi-dash
Download Manager downloadmanager
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy easy-digital-downloads
Easy Hide Login easy-hide-login
eesy_ID2WP – Publish InDesign HTML5 eesy-id2wp-publish-indesign-html5
Elementor Website Builder – more than just a page builder elementor
ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor elementskit-lite
Email Log email-log
Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress email-subscribers
EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents embedpress
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce erp
Estatik Real Estate Plugin estatik
EthPress – Web3 Login ethpress
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar mage-eventpress
Event Tickets and Registration event-tickets
Events Manager – Calendar, Bookings, Tickets, Appointments and more! events-manager
Fancy Product Designer fancy-product-designer
File Manager wp-file-manager
File Manager Pro – Filester filester
FileOrganizer – WordPress File Manager fileorganizer
Fluent Support – Helpdesk & Customer Support Ticket System fluent-support
FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration fluent-boards
Forminator Forms – Contact Form, Payment Form & Custom Form Builder forminator
GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI gamipress
GEO Plugin by Squirrly SEO squirrly-seo
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory geodirectory
Give Tributes give-tributes
GiveWP – Donation Plugin and Fundraising Platform give
Go Live Update Urls go-live-update-urls
Groups – Memberships and Access Control groups
Gutenverse – WordPress Blocks, Page Builder & Site Editor gutenverse
Handily handily
HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates happy-elementor-addons
Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms happyforms
HashBar – Announcement, Notification Bar & Popup Campaign hashbar-wp-notification-bar
Hostel hostel
HT Contact Form – Drag & Drop Form Builder for WordPress ht-contactform
HUSKY – Products Filter for WooCommerce Professional woocommerce-products-filter
Image Buzz image-buzz
Import and export users and customers import-users-from-csv-with-meta
JetEngine jet-engine
JetFormBuilder Stripe Gateway jet-form-builder-stripe-gateway
JetFormBuilder — Dynamic Blocks Form Builder jetformbuilder
JetTricks jet-tricks
JSM Show Post Metadata jsm-show-post-meta
Kadence WooCommerce Email Designer kadence-woocommerce-email-designer
King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder king-addons
Kirki – Freeform Page Builder, Website Builder & Customizer kirki
Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more knit-pay
LayerSlider LayerSlider
Link Library link-library
Live Composer – Free WordPress Website Builder live-composer-page-builder
Live Copy Paste for Elementor – Cross Domain Copy Paste & Page Duplicator live-copy-paste
Mailchimp for WooCommerce mailchimp-for-woocommerce
MailerLite – Signup forms (official) official-mailerlite-sign-up-forms
Malcure Malware Shield — Removal, Repair, Monitor wp-malware-removal
Mang Board mangboard
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution marketking-multivendor-marketplace-for-woocommerce
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates learning-management-system
MasterStudy LMS WordPress Plugin – for Online Courses and Education masterstudy-lms-learning-management-system
MCP Server for WordPress – Connect Claude, ChatGPT & Gemini | AtlasMCP ai-workflow-automation-ai-agent-hub
Meta Box AIO meta-box-aio
Meta Box Frontend Submission mb-frontend-submission
Meta Box User Profile mb-user-profile
miniOrange OTP Login, Verification and SMS Notifications miniorange-otp-verification
Modula Image Gallery – Photo Grid & Video Gallery modula-best-grid-gallery
Mollie Forms mollie-forms
Netgsm netgsm
Newsletters newsletters-lite
NextScripts: Social Networks Auto-Poster social-networks-auto-poster-facebook-twitter-g
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder ninja-forms
Ninja Tables – Easy Data Table Builder ninja-tables
NP Quote Request for WooCommerce woo-rfq-for-woocommerce
Ocean Extra ocean-extra
Online Booking & Scheduling Calendar by vcita meeting-scheduler-by-vcita
Online Scheduling and Appointment Booking System – Bookly bookly-responsive-appointment-booking-tool
OpenStation: Desktop Windows, Dock & Virtual Desktops for WP Admin desktop-mode
Optima Express IDX optima-express
Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization optimole-wp
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction paid-member-subscriptions
Paymattic – Secure, Simple Payment & Donation with Subscription Payments, Recurring Donations, Customer Management wp-payment-form
Payment Plugins for PayPal WooCommerce pymntpl-paypal-woocommerce
Paymob for WooCommerce paymob-for-woocommerce
PayPlus Payment Gateway payplus-payment-gateway
Paytium: Mollie payment forms & donations paytium
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery nextgen-gallery
Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing woocommerce-google-adwords-conversion-tracking-tag
PixelPlay pixelplay
PixelYourSite – Your smart PIXEL (TAG) & API Manager pixelyoursite
Podcast Importer SecondLine podcast-importer-secondline
Points and Rewards for WooCommerce points-and-rewards-for-woocommerce
Post Grid Gutenberg Blocks – PostX ultimate-post
Post Voting System post-voting-system
PowerPress Podcasting plugin by Blubrry powerpress
Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates premium-addons-for-elementor
Premium Blocks – Gutenberg Blocks, Patterns & Templates premium-blocks-for-gutenberg
Premium Packages – Sell Digital Products Securely wpdm-premium-packages
Product Badge, Label, Countdown Timer for WooCommerce – Sale Booster easy-sale-badges-for-woocommerce
Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels webappick-product-feed-for-woocommerce
Product Filter for WooCommerce by WBW woo-product-filter
Product Table & List Builder for WooCommerce wc-product-table-lite
PublishPress Capabilities: User Role Access Control, Admin Area Permissions capability-manager-enhanced
Razorpay Payment Button Plugin razorpay-payment-button
Real3D Flipbook real3d-flipbook
Rename wp-login.php to anything you want rename-wp-loginphp-to-anything-you-want
Repeater Fields for Elementor Forms repeater-for-elementor
Request a Quote for WooCommerce woocommerce-request-a-quote
Restaurant Menu and Food Ordering

[Article truncated — read full content at source]

Source Attribution
This intelligence summary is sourced from Wordfence Blog and curated by CyberHawk Threat Intel for the security community. Full article content is displayed with attribution under fair use for security research and education.

Read original at Wordfence Blog →

Accelerate Your Security Operations

CyberHawk Threat Intel is a complete Cyber Intelligence Platform — one place for every tool a security professional needs. Built by Rudra Verma, Senior Security Architect and Researcher, CyberHawk Consultancy.

IOC Scanner — scan any domain, IP, hash, URL
Live IOC Feed — 3.6M+ indicators, filterable
Infostealer Intelligence — live compromised creds
Live Threat Map — real-time global attack vectors
MISP Threat Feeds — CIRCL, Feodo, Botvrij, more
GitHub Arsenal — curated security tools and scripts
Security Blog — CVE advisories and threat research
Video Courses — cybersecurity training and education
SOPs and Playbooks — SecOps procedures
Analyst Library — references and toolkits
Scan Reports — historical threat intelligence
Cyber News — this feed, aggregated in-platform
Sign Up Free — Full Access Sign Up Free — Unlock All Tools