Last week, there were 260 vulnerabilities disclosed in 207 WordPress Plugins that have been added to the Wordfence Intelligence Vulnerability Database, and there were 147 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.
Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, and webhook integration are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back.
Enterprises, Hosting Providers, and even Individuals can utilize the vulnerability Database API to receive a complete dump of our database of over 40,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
Total Unpatched & Patched Vulnerabilities Last Week
| Patch Status | Number of Vulnerabilities |
|---|---|
| Patched | 217 |
| Partially Patched | 1 |
| Unpatched | 42 |
Total Vulnerabilities by CVSS Severity Last Week
| Severity Rating | Number of Vulnerabilities |
|---|---|
| Medium Severity | 184 |
| High Severity | 66 |
| Critical Severity | 10 |
Total Vulnerabilities by CWE Type Last Week
| Vulnerability Type by CWE | Number of Vulnerabilities |
|---|---|
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 66 |
| Missing Authorization | 58 |
| Exposure of Sensitive Information to an Unauthorized Actor | 21 |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 18 |
| Improper Privilege Management | 15 |
| Authorization Bypass Through User-Controlled Key | 13 |
| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 11 |
| Deserialization of Untrusted Data | 10 |
| Improper Control of Generation of Code ('Code Injection') | 9 |
| Improper Authentication | 6 |
| Unrestricted Upload of File with Dangerous Type | 6 |
| Client-Side Enforcement of Server-Side Security | 5 |
| Cross-Site Request Forgery (CSRF) | 5 |
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | 3 |
| Insufficient Verification of Data Authenticity | 2 |
| Protection Mechanism Failure | 2 |
| URL Redirection to Untrusted Site ('Open Redirect') | 2 |
| Authentication Bypass Using an Alternate Path or Channel | 1 |
| Guessable CAPTCHA | 1 |
| Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | 1 |
| Incorrect Authorization | 1 |
| Missing Authentication for Critical Function | 1 |
| Server-Side Request Forgery (SSRF) | 1 |
| Uncontrolled Resource Consumption | 1 |
| Unverified Password Change | 1 |
Researchers That Contributed to WordPress Security Last Week
| Researcher Name | Number of Vulnerabilities |
|---|---|
| 25 | |
| 10 | |
| 10 | |
| 10 | |
| 6 | |
| 6 | |
| 6 | |
| 5 | |
| 4 | |
| 4 | |
| 4 | |
| 4 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.
WordPress Plugins with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress | acymailing |
| Advanced Contact form 7 DB | advanced-cf7-db |
| Advanced Customized Prompts | advanced-customized-prompts |
| Advanced Partial Payment or Deposit for WooCommerce | advanced-partial-payment-or-deposit-for-woocommerce |
| Advanced Product Fields Extended for WooCommerce | advanced-product-fields-for-woocommerce-extended |
| AI Builder – Generate pages, blocks, images & translate with AI | ai-builder |
| Aruba HiSpeed Cache | aruba-hispeed-cache |
| Awesome Support – WordPress HelpDesk & Support Plugin | awesome-support |
| BackWPup – WordPress Backup & Restore Plugin | backwpup |
| bbPress | bbpress |
| BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server) | woo-bulk-editor |
| Beaver Builder Page Builder – Drag and Drop Website Builder | beaver-builder-lite-version |
| Bold Page Builder | bold-page-builder |
| Bold Timeline Lite | bold-timeline-lite |
| Booking for Appointments and Events Calendar – Amelia | ameliabooking |
| Bookit — Booking & Appointment Calendar | bookit |
| Booktics – Appointment Booking Calendar for Service Businesses | booktics |
| BuddyPress | buddypress |
| Builderall for WordPress | builderall-cheetah-for-wp |
| Bulk Password Reset | bulk-password-reset |
| CatalogX – Catalog Mode, Enquiry & Quotes for WooCommerce | woocommerce-catalog-enquiry |
| Checkout Custom Fields Builder for WooCommerce | checkout-custom-fields-builder-for-woocommerce |
| CODE MONKEYS PROPOSALS – Easily create client proposals from your WordPress admin dashboard | code-monkeys-proposals |
| Contact Form to Chat Apps | Click to Chat to Order – FormyChat | social-contact-form |
| Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress | contact-form-to-db |
| Content Mask | content-mask |
| CoolClock | coolclock |
| CryptoPayment Gateway | cryptopayment-gateway |
| Csomagpontok és Címkék WooCommerce-hez | hungarian-pickup-points-for-woocommerce |
| Custom Menu Wizard Widget | custom-menu-wizard |
| Direct Download for WooCommerce | direct-download-for-woocommerce |
| Domain For Sale – Landing Page Per Domain, Domain Mapping, Offers & Listings | domain-for-sale |
| Drag and Drop File Upload for Elementor Forms | drag-and-drop-file-upload-for-elementor-forms |
| DT LMS – elearning, WordPress LMS Plugin | dt-lms-lite |
| Easy Appointments | easy-appointments |
| Easy Google Fonts | easy-google-fonts |
| EDD Product Catalog Feed by PixelYourSite | edd-products-feed-pro |
| ElasticPress | elasticpress |
| ELEX WooCommerce Request a Quote | elex-request-a-quote |
| Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress | email-subscribers |
| Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar | mage-eventpress |
| Event Tickets and Registration | event-tickets |
| Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce | wp-event-solution |
| EventON – Events Calendar | eventon-lite |
| Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI | everest-forms |
| Featured Image with URL | featured-image-with-url |
| FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment | firebox |
| Flexible Quantity – Measurement Price Calculator for WooCommerce | flexible-quantity-measurement-price-calculator-for-woocommerce |
| Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty | chaty |
| Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder | form-maker |
| Frontegg SAML SSO | frontegg-saml-sso |
| GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI | gamipress |
| Gato GraphQL | gatographql |
| GEO my WP | geo-my-wp |
| Gpx2Graphics | gpx2graphics |
| Graphina – Charts and Graphs For Elementor | graphina-elementor-charts-and-graphs |
| Groundhogg — CRM, Newsletters, and Marketing Automation | groundhogg |
| Gutenverse News – News Blocks for Blog & Magazine Sites | gutenverse-news |
| Hide My WP Ghost – Security & Firewall | hide-my-wp |
| HT Menu – WordPress Mega Menu Builder for Elementor | ht-menu-lite |
| HUSKY – Products Filter for WooCommerce Professional | woocommerce-products-filter |
| Hustle – Email Marketing, Lead Generation, Optins, Popups | wordpress-popup |
| ilGhera Reviso Exporter for WooCommerce | wc-exporter-for-reviso |
| IMPress for IDX Broker | idx-broker-platinum |
| Insert or Embed Articulate Content into WordPress | insert-or-embed-articulate-content-into-wordpress |
| IP2Location Country Blocker | ip2location-country-blocker |
| IPGP Visitors Origin | ipgp-visitors-origin |
| JCH Optimize | jch-optimize |
| JetFormBuilder — Dynamic Blocks Form Builder | jetformbuilder |
| Jetpack – WP Security, Backup, Speed, & Growth | jetpack |
| Kirki – Freeform Page Builder, Website Builder & Customizer | kirki |
| LearnPress – WordPress LMS Plugin for Create and Sell Online Courses | learnpress |
| Live Composer – Free WordPress Website Builder | live-composer-page-builder |
| Loops & Logic | tangible-loops-and-logic |
| LukasApps CAPTCHA tools for Contact Form 7 | contact-form-7-simple-recaptcha |
| Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance | mail-mint |
| MailMunch – Grow your Email List | mailmunch |
| Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits | master-addons |
| Masteriyo LMS – LMS Course Builder, Quizzes & Certificates | learning-management-system |
| MDJM Event Management | mobile-dj-manager |
| Media Library Assistant | media-library-assistant |
| MemberPress Corporate Accounts | memberpress-corporate |
| MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor | metform |
| miniOrange 2FA – Two Factor Authentication for WordPress (OTP, SMS, Email, Google Authenticator) | miniorange-2-factor-authentication |
| MIPL Checkout Fields Manager for WooCommerce – Customize, Organize & Group Checkout Fields. | mipl-wc-checkout-fields |
| Mobile Events Manager | mobile-events-manager |
| MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO | multiple-pages-generator-by-porthas |
| MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions | dc-woocommerce-multi-vendor |
| Music Store – WordPress eCommerce | music-store |
| My Calendar – Accessible Event Manager | my-calendar |
| Nexi XPay Build | nexi-xpay-build |
| Next-Cart Store to WooCommerce Migration | nextcart-woocommerce-migration |
| Ninja Forms – The Contact Form Builder That Grows With You | ninja-forms |
| Notiqoo – Order Notification & Customer Chat for WooCommerce | wc-messaging |
| Online Scheduling and Appointment Booking System – Bookly | bookly-responsive-appointment-booking-tool |
| Open User Map – Interactive Leaflet Maps | open-user-map |
| Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More | themeisle-companion |
| OTP Login & Register Woocommerce | mobile-login-woocommerce |
| Page Visits Counter – Lite | page-visits-counter-lite |
| Passster – Password Protect Pages and Content | content-protector |
| Payment Gateway PayPay for WooCommerce | wc-paypay-gateway |
| Payment Plugins for PayPal WooCommerce | pymntpl-paypal-woocommerce |
| Payment Plugins for Stripe WooCommerce | woo-stripe-payment |
| PDF Builder for WooCommerce. Create invoices,packing slips and more | woo-pdf-invoice-builder |
| Podlove Podcast Publisher | podlove-podcasting-plugin-for-wordpress |
| Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred | mycred |
| Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) | buddyforms |
| Product Filter for WooCommerce by WBW | woo-product-filter |
| Product XML Feed Manager for WooCommerce – Google Shopping, Social Sites, Skroutz & More | product-xml-feeds-for-woocommerce |
| PublishPress Capabilities: User Role Access Control, Admin Area Permissions | capability-manager-enhanced |
| Quads Ads Manager for Google AdSense | quick-adsense-reloaded |
| Quentn WP | quentn-wp |
| Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker | quiz-master-next |
| Rara One Click Demo Import | rara-one-click-demo-import |
| Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) | really-simple-ssl |
| Redux Framework | redux-framework |
| Registration Form for WooCommerce | registration-form-for-woocommerce |
| Relevanssi – A Better Search | relevanssi |
| RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress | computer-repair-shop |
| Repeater Fields for Gravity Forms | repeater-for-gravity-forms |
| Return Refund and Exchange For WooCommerce | woo-refund-and-exchange-lite |
| Robokassa payment gateway for Woocommerce | robokassa |
| Rox Appointment Booking – Appointment Booking Scheduling Solution | rox-appointment-booking |
| Royal Addons for Elementor – Addons and Templates Kit for Elementor | royal-elementor-addons |
| rtMedia for WordPress, BuddyPress and bbPress | buddypress-media |
| RTMKit | rometheme-for-elementor |
| Salon Booking System – Appointment Booking for Salons, Barbershops & Spas | salon-booking-system |
| SEO Flow by LupsOnline | lupsonline-link-netwerk |
| Shirt Product Designer for WooCommerce | woo-shirt-product-designer |
| Shopping Cart & eCommerce Store | wp-easycart |
| Sidebar Manager Light | sidebar-manager-light |
| Simple Ajax Chat – Add a Fast, Secure Chat Box | simple-ajax-chat |
| Simple CAPTCHA with Cloudflare Turnstile | simple-cloudflare-turnstile |
| Simple Membership | simple-membership |
| Simple Payment | simple-payment |
| Sina Extension for Elementor | sina-extension-for-elementor |
| Site Kit by Google – Analytics, Search Console, AdSense, Speed | google-site-kit |
| Site Reviews | site-reviews |
| SiteSkite MCP AI – Connector for Claude, ChatGPT, Cursor & WordPress WebOps | siteskite |
| Sky Addons for Elementor | sky-elementor-addons |
| Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated | slim-seo |
| Smart Marketing SMS and Newsletters Forms | smart-marketing-for-wp |
| SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery | sms-alert |
| Spam protection, Honeypot, Anti-Spam by CleanTalk | cleantalk-spam-protect |
| Sprout Invoices – Client Invoicing & Estimates | sprout-invoices |
| SSL Zen — SSL Certificate Installer & HTTPS Redirects | ssl-zen |
| Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg | astra-sites |
| Sticky Chat Widget – Floating Chat Icons, Contact Form, Call, Click to Chat, Email & Message Buttons | sticky-chat-widget |
| Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers | sunshine-photo-cart |
| SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent | supportcandy |
| SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments | surecart |
| SureRank SEO – Meta Tags, Social Preview, XML Sitemap, Schema & Open Graph | surerank |
| Teddy Bear Customize Addon | teddy-bear-customize-addon |
| Temporary Login Without Password | temporary-login-without-password |
| Thanko Thank You Page Customizer for WooCommerce – Increase Your Sales | woo-thank-you-page-customizer |
| The Events Calendar | the-events-calendar |
| ThemeREX Addons | trx_addons |
| Themify – WooCommerce Product Filter | themify-wc-product-filter |
| Translate WordPress with GTranslate | gtranslate |
| Tutor LMS – eLearning and online course solution | tutor |
| Ultimate Gift Cards for WooCommerce | woo-gift-cards-lite |
| Unbounce Landing Pages | unbounce |
| Unlimited Elements For Elementor | unlimited-elements-for-elementor |
| User Access Manager | user-access-manager |
| User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder | user-registration |
| UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP | userswp |
| Verified Reviews (Avis Vérifiés) | netreviews |
[Article truncated — read full content at source]
Source Attribution
This intelligence summary is sourced from Wordfence Blog and curated by CyberHawk Threat Intel for the security community. Full article content is displayed with attribution under fair use for security research and education. Read original at Wordfence Blog → Accelerate Your Security OperationsCyberHawk Threat Intel is a complete Cyber Intelligence Platform — one place for every tool a security professional needs. Built by Rudra Verma, Senior Security Architect and Researcher, CyberHawk Consultancy. IOC Scanner — scan any domain, IP, hash, URL
Live IOC Feed — 3.6M+ indicators, filterable
Infostealer Intelligence — live compromised creds
Live Threat Map — real-time global attack vectors
MISP Threat Feeds — CIRCL, Feodo, Botvrij, more
GitHub Arsenal — curated security tools and scripts
Security Blog — CVE advisories and threat research
Video Courses — cybersecurity training and education
SOPs and Playbooks — SecOps procedures
Analyst Library — references and toolkits
Scan Reports — historical threat intelligence
Cyber News — this feed, aggregated in-platform
|