WordPress Vulnerability Report — April 2, 2025

Last week, 542 new vulnerabilities emerged in the WordPress ecosystem, including 520 plugins and 22 themes. 275 of the vulnerable plugins and themes remain unpatched, but Solid Security Pro users are protected by virtual patching from Patchstack.

Sarah Ulmer

Published:Apr 2, 2025

Filed Under:WordPress Vulnerability Report

Reading Time:96 min.

In this report, 542 vulnerabilities have been publicly disclosed. Security patches for 267 of these plugins and themes are available now, so run those updates as soon as possible. If you’re a Solid Security Pro user, the version management tool may have already warned you and updated these plugins, depending on your settings.

Additionally, there are 275 plugin and theme vulnerabilities with no patch available yet. If you’re a Solid Security Pro user, those vulnerabilities are already protected by the Solid Security firewall. Virtual patches from Patchstack will be applied when a vulnerability is considered high or medium risk. If no patch is forthcoming from the vendor or the vulnerable software has been marked “closed” and dropped from the official WordPress repositories, you should deactivate it soon and look for alternative solutions.

Along with poor user account security, vulnerable plugins and themes are among the top reasons why WordPress websites get hacked. Unfortunately, cyberattacks are increasing in volume and sophistication. They’re also increasingly aimed at small to mid-sized businesses.

1. WordPress Core
2. WordPress Plugins — 263 Patched / 257 Unpatched

2.1 Themesflat Addons For Elementor
2.2 GTM Kit – Google Tag Manager & GA4 integration
2.3 OSM – OpenStreetMap
2.4 WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder
2.5 WPCargo Track & Trace
2.6 WP Mobile Bottom Menu
2.7 IMPress for IDX Broker
2.8 Sliced Invoices – WordPress Invoice Plugin
2.9 Flag Icons
2.10 Fusion Page Builder
2.11 Gallery – Photo Albums Plugin
2.12 ELEX WooCommerce Request a Quote
2.13 Quick Interest Slider
2.14 Safe Ai Malware Protection for WP
2.15 teachPress
2.16 Timeline Event History
2.17 Directory Listings WordPress plugin – uListing
2.18 Cal.com
2.19 Cryptocurrency Widgets Pack
2.20 Click to Chat – WP Support All-in-One Floating Widget
2.21 Swiss Toolkit For WP
2.22 Swiss Toolkit For WP
2.23 Price by Quantity & Bulk Quantity Discounts for WooCommerce
2.24 Group Chat & Video Chat by AtomChat
2.25 Simple Owl Carousel
2.26 Slider Path for Elementor
2.27 StaticPress
2.28 Custom Database Applications by Caspio
2.29 Google SEO Pressor for Rich snippets
2.30 History Log by click5
2.31 My auctions allegro
2.32 Behance Portfolio Manager
2.33 TGG – WP Optimizer
2.34 Uptime Robot Plugin for WordPress
2.35 Uptime Robot Plugin for WordPress
2.36 WP Link Preview
2.37 ACME Divi Modules
2.38 WordPress Appointment Booking and Online Scheduling Plugin by Appointy
2.39 CF7 Spreadsheets
2.40 Checklist
2.41 EZ SQL Reports Shortcode Widget and DB Backup
2.42 Twice Commerce – Easy Rental Booking System
2.43 Flipdish Ordering System
2.44 Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One
2.45 Appointify
2.46 RSVPMaker
2.47 Advanced WooCommerce Product Sales Reporting – Statistics & Forecast
2.48 WP AutoKeyword
2.49 SimplyRETS Real Estate IDX
2.50 Auto Post After Image Upload
2.51 Connector to CiviCRM with CiviMcRestFace
2.52 Leadfox for WordPress
2.53 Ni WooCommerce Product Enquiry
2.54 Send E-mail
2.55 Welcome Popup
2.56 WP Copy Media URL
2.57 Related Posts Widget with Thumbnails
2.58 Apimo Connector
2.59 CBX Poll
2.60 ContentMX Content Publisher
2.61 CookieHint WP
2.62 Custom Content Scrollbar
2.63 WordPress Testimonials Slider
2.64 WordPress Testimonials Slider
2.65 WordPress Testimonials Slider
2.66 Rio Video Gallery
2.67 Shopper – Affiliate Link Management, 25000+ Brand Partnerships & Creative Product Displays
2.68 Simple-Audioplayer
2.69 SP Blog Designer
2.70 Ultimate Live Cricket WordPress Lite
2.71 AB Google Map Travel (AB-MAP)
2.72 byBrick Accordion
2.73 CoverManager
2.74 OpenMenu – The official plugin for OpenMenu
2.75 wordpress related Posts with thumbnails
2.76 Terms Before Download
2.77 Ultimate Push Notifications ( Mobile / Desktop ), Receive Notification From WooCommerce, BuddyPress, WordPress Default Events & Many More
2.78 Varnish WordPress
2.79 PostmarkApp Email Integrator
2.80 PostmarkApp Email Integrator
2.81 Rich Text Editor
2.82 Simple Contact Forms
2.83 Actionwear products sync
2.84 Infusionsoft Web Form JavaScript
2.85 Processing Projects
2.86 Useinfluence
2.87 Chat by Chatwee
2.88 DesignO
2.89 Notification Bar, Sticky Notification Bar, Sticky Welcome Bar for any theme
2.90 Salesmate Add-On for Gravity Forms
2.91 Salesmate Add-On for Gravity Forms
2.92 Ethiopian Calendar
2.93 AdSense Privacy Policy
2.94 Advanced Dewplayer
2.95 Advanced Post Search
2.96 AI Preloader
2.97 Alert Box Block – Display notice/alerts in the front end
2.98 AlphaOmega Captcha & Anti-Spam Filter
2.99 Amazing service box Addons For WPBakery Page Builder
2.100 ANAC XML Render
2.101 Arrow Maps
2.102 AppExperts
2.103 ARPrice
2.104 Auto Load Next Post
2.105 AvaiBook
2.106 Awesome Logos
2.107 Ayyash Studio
2.108 banner-manager
2.109 Beautiful Link Preview
2.110 Blue Captcha
2.111 BMo Expo
2.112 Breezing Forms
2.113 Browser Address Bar Color
2.114 Browser Caching with .htaccess
2.115 Cackle
2.116 CallPhone’r
2.117 CAS Maestro
2.118 Cazamba
2.119 Contact Form 7 Material Design
2.120 Clear Sucuri Cache
2.121 Clink
2.122 CopyLink
2.123 Menu Duplicator
2.124 CSV to Responsive Tables
2.125 cTabs
2.126 Custom Product Stickers for Woocommerce
2.127 Custom Script Integration
2.128 DAP to Autoresponders Email Syncing
2.129 Driving Directions
2.130 DesignThemes Core Features
2.131 Product Catalog
2.132 ????? ???? ??????? ????
2.133 Multi Days Events and Multi Events in One Day Calendar
2.134 Duplicate Page and Post
2.135 Duplicate Page and Post
2.136 Easy Page Transition
2.137 Exit Popup Free
2.138 External image replace
2.139 Secret Meta
2.140 Fiverr.com Official Search Box
2.141 Fix Rss Feeds
2.142 Flatty
2.143 Flickr set slideshows
2.144 Flickr set slideshows
2.145 Frndzk Expandable Bottom Bar
2.146 Generate Post Thumbnails
2.147 GMO Font Agent
2.148 Google Font Fix
2.149 GP Back To Top
2.150 Hacklog Remote Image Autosave
2.151 IG Shortcodes
2.152 Image Captcha
2.153 Image Slider / Slideshow Pearlbells
2.154 Photo Slideshow (Responsive)
2.155 include-file
2.156 Include URL
2.157 Include URL
2.158 Info Boxes Shortcode and Widget
2.159 issuuPress
2.160 JiangQie Official Website Mini Program
2.161 jQuery Dropdown Menu
2.162 Kento WordPress Stats
2.163 Key4ce osTicket Bridge
2.164 KK I Like It
2.165 LH OGP Meta
2.166 Lightview Plus
2.167 Login Alert
2.168 Login Redirect
2.169 LWS SMS
2.170 Map Contact
2.171 Message ticker
2.172 Microblog Poster
2.173 Mobile Navigation
2.174 Music Press Pro
2.175 My Bootstrap Menu
2.176 My Default Post Content
2.177 NanoSupport
2.178 NertWorks All in One Social Share Tools
2.179 NextGEN Gallery Voting
2.180 Nmedia MailChimp
2.181 Easy 301 Redirects
2.182 OK Poster Group
2.183 Omnify
2.184 OmniLeads Scripts and Tags Manager
2.185 OSS Upload
2.186 Page Takeover
2.187 Pesapal Gateway for Woocommerce
2.188 Pop-Up Chop Chop
2.189 PostMash
2.190 Pretty file links
2.191 Pro Rank Tracker
2.192 Quick Localization
2.193 Related Posts via Categories
2.194 Replace Default Words
2.195 Rewrite
2.196 RJ Quickcharts
2.197 SH Email Alert
2.198 ShowTime Slideshow
2.199 Shuffle
2.200 Simple Optimizer
2.201 Simple Rating
2.202 Simple Trackback Disabler
2.203 Simple:Press
2.204 Smart Maintenance Mode
2.205 So-Called Air Quotes
2.206 SoJ SoundSlides
2.207 SoundCloud Ultimate
2.208 sourceplay-navermap
2.209 SpeakPipe
2.210 STEdb Forms
2.211 Super Simple Subscriptions
2.212 Super Static Cache
2.213 Teleport
2.214 Terms of Use
2.215 Text Selection Color
2.216 The Visitor Counter
2.217 Tidekey
2.218 Toggle Box
2.219 Trackserver
2.220 Translator
2.221 Typekit plugin for WordPress
2.222 Top Bar
2.223 Ultimate Security Checker
2.224 Upload Quota per User
2.225 Video Embedder
2.226 Visual Text Editor
2.227 wA11y – The Web Accessibility Toolbox
2.228 wBounce
2.229 Weather Layer
2.230 WordPress Admin Bar Improved
2.231 WordPress SQL Backup
2.232 WP Cards
2.233 WP Church Donation
2.234 WP Colorful Tag Cloud
2.235 WP Database Optimizer
2.236 WP Database Optimizer
2.237 WP e-Commerce Style Email
2.238 Magic Embeds
2.239 WP Featured Entries
2.240 WP Hotjar
2.241 Job Colors for WP Job Manager
2.242 WP Multistore Locator
2.243 WP Odoo Form Integrator
2.244 WP-OGP
2.245 WP Parallax Content Slider
2.246 VaultRE Contact Form 7
2.247 WP Profitshare
2.248 WP Ride Booking
2.249 WP Social Widget
2.250 WP Supersized
2.251 WP Ultimate Search
2.252 WP01
2.253 WordPres ????
2.254 WP Event Ticketing
2.255 XV Random Quotes
2.256 YouTube SimpleGallery
2.257 Yummly Rich Recipes
2.258 WordPress Importer
2.259 ElementsKit Elementor Addons and Templates
2.260 Spectra Gutenberg Blocks – Website Builder for the Block Editor
2.261 Smush Image Optimization – Optimize Images | Compress & Lazy Load Images | Convert WebP & AVIF | Image CDN
2.262 TablePress – Tables in WordPress made easy
2.263 Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider
2.264 MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor
2.265 Happy Addons for Elementor
2.266 GDPR Cookie Compliance – Cookie Banner, Cookie Consent, Cookie Notice – CCPA, DSGVO, RGPD
2.267 Translate Multilingual sites – TranslatePress
2.268 Photo Gallery by 10Web – Mobile-Friendly Image Gallery
2.269 Photo Gallery by 10Web – Mobile-Friendly Image Gallery
2.270 GiveWP – Donation Plugin and Fundraising Platform
2.271 Pods – Custom Content Types and Fields
2.272 SEO Plugin by Squirrly SEO
2.273 The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid
2.274 Event Tickets and Registration
2.275 Kubio AI Page Builder
2.276 LearnPress – WordPress LMS Plugin
2.277 PowerPack Elementor Addons (Free Widgets, Extensions and Templates)
2.278 Product Import Export for WooCommerce – Import Export Product CSV Suite
2.279 Product Import Export for WooCommerce – Import Export Product CSV Suite
2.280 Product Import Export for WooCommerce – Import Export Product CSV Suite
2.281 Nested Pages
2.282 Booking for Appointments and Events Calendar – Amelia
2.283 Advanced Woo Search
2.284 Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid
2.285 Media Library Assistant
2.286 Drag and Drop Multiple File Upload for Contact Form 7
2.287 Drag and Drop Multiple File Upload for Contact Form 7
2.288 Ultimate Dashboard – Custom WordPress Dashboard
2.289 User Registration & Membership – Custom Registration Form, Login Form, and User Profile
2.290 User Registration & Membership – Custom Registration Form, Login Form, and User Profile
2.291 Export and Import Users and Customers
2.292 Export and Import Users and Customers
2.293 Export and Import Users and Customers
2.294 Export and Import Users and Customers
2.295 Advanced iFrame
2.296 Advanced iFrame
2.297 Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
2.298 Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
2.299 Simple Banner – Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website
2.300 Structured Content (JSON-LD) #wpsc
2.301 Ultimate Blocks – WordPress Blocks Plugin
2.302 Zapier for WordPress
2.303 Greenshift – animation and page builder blocks
2.304 Contact Form & SMTP Plugin for WordPress by PirateForms
2.305 Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker
2.306 SecuPress Free — WordPress Security
2.307 Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX
2.308 Booster for WooCommerce
2.309 Cost Calculator Builder
2.310 Float menu – awesome floating side menu
2.311 LeadConnector
2.312 Ads by WPQuads – Adsense Ads, Banner Ads, Popup Ads
2.313 Ads by WPQuads – Adsense Ads, Banner Ads, Popup Ads
2.314 RomethemeKit For Elementor
2.315 Analytify – Google Analytics Dashboard For WordPress (GA4 analytics made easy)
2.316 WP Google Review Slider
2.317 Conversios: Google Analytics GA4, Google Ads, GTM & Multiple Pixel Tracking
2.318 Gum Elementor Addon
2.319 InstaWP Connect – 1-click WP Staging & Migration
2.320 King Addons for Elementor – Free Elements, Widgets, Templates, and Features for Elementor
2.321 ?????? ??? ? ??? ??????? (??? ?????? ? ??????? ??? ??????)
2.322 Quiz Maker
2.323 Slider by 10Web – Responsive Image Slider
2.324 Slider by 10Web – Responsive Image Slider
2.325 SyntaxHighlighter Evolved
2.326 FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce
2.327 FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce
2.328 WP Travel Engine – Tour Booking Plugin – Tour Operator Software
2.329 WP Travel Engine – Tour Booking Plugin – Tour Operator Software
2.330 Import Export Suite for CSV and XML Datafeed
2.331 Import Export Suite for CSV and XML Datafeed
2.332 Product Labels For Woocommerce (Sale Badges)
2.333 Product Labels For Woocommerce (Sale Badges)
2.334 AFI – The Easiest Integration Plugin
2.335 Webhook Automator & Contact Form Integration to Automate 280+ Platforms – Bit Integrations
2.336 Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More
2.337 Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings
2.338 Favorites
2.339 Social Reviews & Recommendations
2.340 Job Postings
2.341 Job Postings
2.342 LatePoint – Calendar Booking Plugin for Appointments and Events
2.343 Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
2.344 Five Star Restaurant Reservations – WordPress Booking Plugin
2.345 Sensei LMS – Online Courses, Quizzes, & Learning
2.346 WP Date and Time Shortcode
2.347 WP Tabs – Responsive Tabs and Custom Product Tabs
2.348 ?=== Export All Posts, Products, Orders, Refunds & Users
2.349 Chat Widget: Customer Support Button with SMS Call Button, Click to Chat Messenger, Live Chat Support Chat Button – Bit Assist
2.350 Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder
2.351 Essential Real Estate
2.352 Registrations for the Events Calendar – Event Registration Plugin
2.353 WP Compress – Instant Performance & Speed Optimization
2.354 WP Compress – Instant Performance & Speed Optimization
2.355 Awesome Support – WordPress HelpDesk & Support Plugin
2.356 Cozy Blocks – Page Builder for Gutenberg & Site Editor with Post Blocks, WooCommerce Blocks, Magazine Blocks & WordPress Gutenberg Blocks
2.357 Event Manager and Tickets Selling Plugin for WooCommerce – WpEvently – WordPress Plugin
2.358 Event Manager and Tickets Selling Plugin for WooCommerce – WpEvently – WordPress Plugin
2.359 WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting
2.360 JS Help Desk – The Ultimate Help Desk & Support Plugin
2.361 JS Help Desk – The Ultimate Help Desk & Support Plugin
2.362 JS Help Desk – The Ultimate Help Desk & Support Plugin
2.363 JS Help Desk – The Ultimate Help Desk & Support Plugin
2.364 JS Help Desk – The Ultimate Help Desk & Support Plugin
2.365 Shipmondo – A complete shipping solution for WooCommerce
2.366 WooCommerce Wishlist (High customization, fast setup,Free Elementor Wishlist, most features)
2.367 Quiz Cat – WordPress Quiz Plugin
2.368 WPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce
2.369 Audio Album
2.370 Specific Content For Mobile – Customize the mobile version without redirections
2.371 AliExpress Dropshipping Plugin for WooCommerce – AliNext
2.372 Doneren met Mollie
2.373 Inline Image Upload for BBPress
2.374 Stylish Price List – Price Table Builder & QR Code Restaurant Menu
2.375 WP Posts Carousel
2.376 WP Posts Carousel
2.377 Chartify – WordPress Chart Plugin
2.378 Restaurant Menu and Food Ordering
2.379 Newsletters
2.380 Newsletters
2.381 Themify Event Post
2.382 Themify Event Post
2.383 Tickera – WordPress Event Ticketing
2.384 Vimeotheque: Vimeo WordPress Plugin
2.385 WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg
2.386 Scheduled & Automatic Order Status Controller for WooCommerce
2.387 Active Products Tables for WooCommerce. Use constructor to create tables
2.388 Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates
2.389 Sitekit
2.390 The Pack Elementor addons (Header Footer & WooCommerce Builder, Template Library)
2.391 The Pack Elementor addons (Header Footer & WooCommerce Builder, Template Library)
2.392 Appointment Booking and Scheduling Calendar Plugin – WP Timetics
2.393 Vitepos – Point of sale (POS) plugin for WooCommerce
2.394 WP-Recall – Registration, Profile, Commerce & More
2.395 Currency Switcher for WooCommerce
2.396 Custom Field For WP Job Manager
2.397 Dr. Flex
2.398 Dropdown multisite selector
2.399 Taxi Booking Manager for WooCommerce – WordPress plugin | Ecab
2.400 Event post
2.401 Event Tickets with Ticket Scanner
2.402 Flexible Cookies
2.403 WP Fast Total Search – The Power of Indexed Search
2.404 Greek Multi Tool – Ultimate Greek Language Toolkit for WordPress
2.405 Just Writing Statistics
2.406 Novelist
2.407 Off-Canvas Sidebars & Menus (Slidebars)
2.408 Quotes llama
2.409 SearchIQ – The Search Solution
2.410 SKT Addons for Elementor
2.411 SKU Generator for WooCommerce
2.412 Sunshine Photo Cart: Free Client Photo Galleries for Photographers
2.413 WordPress Tour & Travel Booking Plugin for WooCommerce – WpTravelly
2.414 WishSuite – Wishlist for WooCommerce
2.415 WP Docs
2.416 Team Manager – Team Member Showcase with grid, slider, table Elementor widget & shortcode
2.417 The Ultimate WordPress Toolkit – WP Extended
2.418 YayExtra – WooCommerce Extra Product Options
2.419 3DPrint Lite
2.420 Exchange Rates
2.421 Football Pool
2.422 Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms
2.423 RPS Include Content
2.424 Serial Codes Generator and Validator with WooCommerce Support
2.425 Usermaven
2.426 One to one user Chat by WPGuppy
2.427 Leaky Paywall
2.428 Login Widget for Ultimate Member
2.429 Cloudflare Turnstile or reCAPTCHA For any Pages, to Block Spam and Hackers Attack.
2.430 Terms & Conditions Per Product
2.431 TWB Woocommerce Reviews
2.432 ValidateCertify Free
2.433 WooCommerce Fattureincloud
2.434 WP Cassify
2.435 WP Compress for MainWP
2.436 Better Section Navigation
2.437 Custom Fields Account Registration For Woocommerce
2.438 Houzez Property Feed
2.439 Custom Login Logo
2.440 Our Team Members – Team Members WordPress Plugin
2.441 PDF for WPForms + Drag and Drop Template Builder
2.442 wordpress publish post email notification
2.443 Stock Sync for WooCommerce with Google Sheets | WooCommerce Bulk Edit, Stock Management, Inventory Management System & more – FlexStock
2.444 Product Author for WooCommerce
2.445 wpShopGermany IT-RECHT KANZLEI
2.446 Anthologize
2.447 Digital License Manager
2.448 FormLift for Infusionsoft Web Forms
2.449 Simple Giveaways – Grow your business, email lists and traffic with contests
2.450 SNORDIAN’s H5PxAPIkatchu
2.451 Cool Author Box – For Widget and Post Content
2.452 IP Locator
2.453 jAlbum Bridge
2.454 jAlbum Bridge
2.455 Listamester
2.456 Contact Form, Drag and Drop Form Builder Plugin – Live Forms
2.457 Simplebooklet PDF Viewer and Embedder
2.458 Verge3D Publishing and E-Commerce
2.459 Textmetrics
2.460 Lead Form Data Collection to CRM
2.461 Zoho Billing – Embed Payment Form
2.462 Accounting for WooCommerce
2.463 Christmas Panda
2.464 Clearout Email Validator – Real-Time Email Verification on WordPress Forms
2.465 Comment Approved Notifier Extended
2.466 EZ SQL Reports Shortcode Widget and DB Backup
2.467 EZ SQL Reports Shortcode Widget and DB Backup
2.468 Gallery for Social Photo
2.469 Hesabfa Accounting
2.470 Slider by BestWebSoft
2.471 Subscribe to Download Lite – Download after Email Subscription Form WordPress Plugin
2.472 Subscribe to Download Lite – Download after Email Subscription Form WordPress Plugin
2.473 Chatbox Manager
2.474 Web Directory Free
2.475 WordPress WP-Advanced-Search
2.476 WP Google Street View (with 360° virtual tour) & Google maps + Local SEO
2.477 WP Subscription Forms – Subscription Form Plugin for WordPress
2.478 Z Companion
2.479 Administrator Z
2.480 Store Locator Widget
2.481 Support Genix – Helpdesk & Customer Support Ticket System
2.482 WIP WooCarousel Lite
2.483 About Author
2.484 Better WishList API
2.485 Gift Message for WooCommerce
2.486 Stylish Google Sheet Reader 4.0 – Seamlessly Embed Google Sheets as Responsive Data Tables
2.487 CM Download Manager – Simplify file sharing with powerful download management
2.488 Multiple Shipping And Billing Address For Woocommerce
2.489 Image Wall
2.490 Next-Cart Store to WooCommerce Migration
2.491 Cart tracking for WooCommerce
2.492 CRM and Lead Management by vcita
2.493 DICOM Support
2.494 Primer MyData for Woocommerce
2.495 WP2LEADS | WordPress und KlickTipp einfach verbinden – WooCommerce und KlickTipp einfach verbinden
2.496 xili-dictionary
2.497 MDJM Event Management
2.498 WPC Smart Upsell Funnel for WooCommerce
2.499 Material Dashboard
2.500 Hostel
2.501 Hostel
2.502 AEC Kiosque
2.503 BizCalendar Web
2.504 EO4WP: EmailOctopus for WordPress
2.505 MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet
2.506 Your Simple SVG Support
2.507 Bitspecter Suite
2.508 Booknetic
2.509 Bridge Core
2.510 BWL Advanced FAQ Manager
2.511 Fusion Builder
2.512 JetBlocks For Elementor
2.513 JetSearch
2.514 JetSmartFilters
2.515 JetWooBuilder
2.516 JetProductGallery
2.517 Smart Maintenance Mode
2.518 tagDiv Composer
2.519 tagDiv Composer
2.520 Shortcodes by United Themes

3. WordPress Themes — 4 Patched / 18 Unpatched

3.1 AuraMart
3.2 Hester
3.3 MorningTime Lite
3.4 StoreBiz
3.5 Build
3.6 Churel
3.7 City Store
3.8 Navigation Tree Elementor
3.9 newseqo
3.10 RainbowNews
3.11 Rapyd Payment Extension for WooCommerce
3.12 Shopo
3.13 Themify Sidepane WordPress Theme
3.14 Traveler
3.15 Traveler
3.16 Traveler
3.17 Traveler
3.18 Whitish Lite
3.19 Big Store
3.20 Unlimited
3.21 Real Estate 7
3.22 WP Weixin

Our WordPress Vulnerability Report covers the latest emerging WordPress plugin, theme, and core vulnerabilities. Each vulnerability will have a severity rating of Low, Medium, High, or Critical. Responsible disclosure of vulnerabilities is essential to keeping the WordPress community safe. Please share this report to help spread the word and make WordPress — and the web — more secure.

WordPress Core

WordPress 6.8 Release Candidate 2 is ready for download and testing! This version of the WordPress software is under development. Please do not install, run, or test this version of WordPress on production or mission-critical websites. Instead, it’s recommended that you evaluate RC2 on a test server and site.

WordPress Plugins — 263 Patched / 257 Unpatched

Plugin:: Themesflat Addons For Elementor
Plugin Slug:: themesflat-addons-for-elementor
Installations: 40,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31567

Plugin:: GTM Kit – Google Tag Manager & GA4 integration
Plugin Slug:: gtm-kit
Installations: 30,000+
Vulnerability:: Sensitive Data Exposure
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-31001

Plugin:: OSM – OpenStreetMap
Plugin Slug:: osm
Installations: 10,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31557

Plugin:: WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder
Plugin Slug:: wdesignkit
Installations: 10,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-12189

Plugin:: WPCargo Track & Trace
Plugin Slug:: wpcargo
Installations: 10,000+
Vulnerability:: Insecure Direct Object References (IDOR)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31609

Plugin:: WP Mobile Bottom Menu
Plugin Slug:: mobile-bottom-menu-for-wp
Installations: 8,000+
Vulnerability:: Broken Access Control
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31525

Plugin:: IMPress for IDX Broker
Plugin Slug:: idx-broker-platinum
Installations: 7,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31556

Plugin:: Sliced Invoices – WordPress Invoice Plugin
Plugin Slug:: sliced-invoices
Installations: 6,000+
Vulnerability:: Insecure Direct Object References (IDOR)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31628

Plugin:: Flag Icons
Plugin Slug:: language-icons-flags-switcher
Installations: 5,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31575

Plugin:: Fusion Page Builder
Plugin Slug:: fusion
Installations: 4,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31549

Plugin:: Gallery – Photo Albums Plugin
Plugin Slug:: easy-media-gallery
Installations: 2,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31586

Plugin:: ELEX WooCommerce Request a Quote
Plugin Slug:: elex-request-a-quote
Installations: 2,000+
Vulnerability:: Broken Access Control
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31406

Plugin:: Quick Interest Slider
Plugin Slug:: quick-interest-slider
Installations: 2,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-26738

Plugin:: Safe Ai Malware Protection for WP
Plugin Slug:: safe-ai-malware-protection-for-wp
Installations: 2,000+
Vulnerability:: Broken Access Control
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31545

Plugin:: teachPress
Plugin Slug:: teachpress
Installations: 2,000+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-1320

Plugin:: Timeline Event History
Plugin Slug:: timeline-event-history
Installations: 2,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31595

Plugin:: Directory Listings WordPress plugin – uListing
Plugin Slug:: ulisting
Installations: 2,000+
Vulnerability:: Privilege Escalation
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-1653

Plugin:: Cal.com
Plugin Slug:: cal-com
Installations: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31604

Plugin:: Cryptocurrency Widgets Pack
Plugin Slug:: cryptocurrency-widgets-pack
Installations: 1,000+
Vulnerability:: Broken Access Control
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31539

Plugin:: Click to Chat – WP Support All-in-One Floating Widget
Plugin Slug:: support-chat
Installations: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31092

Plugin:: Swiss Toolkit For WP
Plugin Slug:: swiss-toolkit-for-wp
Installations: 1,000+
Vulnerability:: Broken Access Control
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31546

Plugin:: Swiss Toolkit For WP
Plugin Slug:: swiss-toolkit-for-wp
Installations: 1,000+
Vulnerability:: Broken Access Control
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31544

Plugin:: Price by Quantity & Bulk Quantity Discounts for WooCommerce
Plugin Slug:: wholesale-pricing-woocommerce
Installations: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31598

Plugin:: Group Chat & Video Chat by AtomChat
Plugin Slug:: atomchat
Installations: 800+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31532

Plugin:: Simple Owl Carousel
Plugin Slug:: simple-owl-carousel
Installations: 700+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31535

Plugin:: Slider Path for Elementor
Plugin Slug:: slider-path
Installations: 700+
Vulnerability:: Broken Access Control
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31529

Plugin:: StaticPress
Plugin Slug:: staticpress
Installations: 700+
Vulnerability:: Broken Access Control
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31528

Plugin:: Custom Database Applications by Caspio
Plugin Slug:: custom-database-applications-by-caspio
Installations: 600+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31559

Plugin:: Google SEO Pressor for Rich snippets
Plugin Slug:: google-seo-author-snippets
Installations: 600+
Vulnerability:: Broken Access Control
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31530

Plugin:: History Log by click5
Plugin Slug:: history-log-by-click5
Installations: 600+
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2025-31531

Plugin:: My auctions allegro
Plugin Slug:: my-auctions-allegro-free-edition
Installations: 600+
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-31542

Plugin:: Behance Portfolio Manager
Plugin Slug:: portfolio-manager-powered-by-behance
Installations: 600+
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-31526

Plugin:: TGG – WP Optimizer
Plugin Slug:: tgg-wp-optimizer
Installations: 600+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31463

Plugin:: Uptime Robot Plugin for WordPress
Plugin Slug:: uptime-robot-monitor
Installations: 600+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31562

Plugin:: Uptime Robot Plugin for WordPress
Plugin Slug:: uptime-robot-monitor
Installations: 600+
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-31547

Plugin:: WP Link Preview
Plugin Slug:: wp-link-preview
Installations: 600+
Vulnerability:: Server Side Request Forgery (SSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31527

Plugin:: ACME Divi Modules
Plugin Slug:: acme-divi-modules
Installations: 500+
Vulnerability:: Broken Access Control
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31540

Plugin:: WordPress Appointment Booking and Online Scheduling Plugin by Appointy
Plugin Slug:: appointy-appointment-scheduler
Installations: 500+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31601

Plugin:: CF7 Spreadsheets
Plugin Slug:: cf7-spreadsheets
Installations: 500+
Vulnerability:: Settings Change
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31603

Plugin:: Checklist
Plugin Slug:: checklist
Installations: 500+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31538

Plugin:: EZ SQL Reports Shortcode Widget and DB Backup
Plugin Slug:: elisqlreports
Installations: 500+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2025-2319

Plugin:: Twice Commerce – Easy Rental Booking System
Plugin Slug:: embed-rentle
Installations: 500+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31543

Plugin:: Flipdish Ordering System
Plugin Slug:: flipdish-ordering-system
Installations: 500+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-30601

Plugin:: Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One
Plugin Slug:: ai-auto-tool
Installations: 400+
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-31564

Plugin:: Appointify
Plugin Slug:: appointify
Installations: 400+
Vulnerability:: Arbitrary File Upload
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31577

Plugin:: RSVPMaker
Plugin Slug:: rsvpmaker
Installations: 400+
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2025-31552

Plugin:: Advanced WooCommerce Product Sales Reporting – Statistics & Forecast
Plugin Slug:: webd-woocommerce-advanced-reporting-statistics
Installations: 400+
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2025-31553

Plugin:: WP AutoKeyword
Plugin Slug:: wp-autokeyword
Installations: 400+
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2025-31579

Plugin:: SimplyRETS Real Estate IDX
Plugin Slug:: simply-rets
Installations: 300+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31010

Plugin:: Auto Post After Image Upload
Plugin Slug:: auto-post-after-image-upload
Installations: 200+
Vulnerability:: Broken Access Control
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31611

Plugin:: Connector to CiviCRM with CiviMcRestFace
Plugin Slug:: connector-civicrm-mcrestface
Installations: 200+
Vulnerability:: Broken Access Control
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31618

Plugin:: Leadfox for WordPress
Plugin Slug:: leadfox
Installations: 200+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-31585

Plugin:: Ni WooCommerce Product Enquiry
Plugin Slug:: ni-woocommerce-product-enquiry
Installations: 200+
Vulnerability:: Broken Access Control
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-31580

Plugin:: Send E-mail
Plugin Slug:: send-e-mail
Installations: 200+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31592

Plugin:: Welcome Popup
Plugin Slug:: welcome-popup
Installations: 200+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31605

Plugin:: WP Copy Media URL
Plugin Slug:: wp-copy-media-url
Installations: 200+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-31583

Plugin:: Related Posts Widget with Thumbnails
Plugin Slug:: advanced-css3-related-posts-widget
Installations: 100+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-31570

Plugin:: Apimo Connector
Plugin Slug:: apimo
Installations: 100+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31602

Plugin:: CBX Poll
Plugin Slug:: cbxpoll
Installations: 100+
Vulnerability:: PHP Object Injection
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2025-31612

Plugin:: ContentMX Content Publisher
Plugin Slug:: contentmx-content-publisher
Installations: 100+
Vulnerability:: Broken Access Control
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31555

Plugin:: CookieHint WP
Plugin Slug:: cookiehint-wp
Installations: 100+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31608

Plugin:: Custom Content Scrollbar
Plugin Slug:: custom-content-scrollbar
Installations: 100+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31574

Plugin:: WordPress Testimonials Slider
Plugin Slug:: elfsight-testimonials-slider
Installations: 100+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31588

Plugin:: WordPress Testimonials Slider
Plugin Slug:: elfsight-testimonials-slider
Installations: 100+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31587

Plugin:: WordPress Testimonials Slider
Plugin Slug:: elfsight-testimonials-slider
Installations: 100+
Vulnerability:: Broken Access Control
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31584

Plugin:: Rio Video Gallery
Plugin Slug:: rio-video-gallery
Installations: 100+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-31566

Plugin:: Shopper – Affiliate Link Management, 25000+ Brand Partnerships & Creative Product Displays
Plugin Slug:: shopper
Installations: 100+
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2025-31534

Plugin:: Simple-Audioplayer
Plugin Slug:: simple-audioplayer
Installations: 100+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31607

Plugin:: SP Blog Designer
Plugin Slug:: sp-blog-designer
Installations: 100+
Vulnerability:: Broken Access Control
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31606

Plugin:: Ultimate Live Cricket WordPress Lite
Plugin Slug:: ultimate-live-cricket-lite
Installations: 100+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31597

Plugin:: AB Google Map Travel (AB-MAP)
Plugin Slug:: ab-google-map-travel
Installations: 90+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-31613

Plugin:: byBrick Accordion
Plugin Slug:: bybrick-accordion
Installations: 80+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31621

Plugin:: CoverManager
Plugin Slug:: covermanager
Installations: 80+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31620

Plugin:: OpenMenu – The official plugin for OpenMenu
Plugin Slug:: open-menu
Installations: 80+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31593

Plugin:: wordpress related Posts with thumbnails
Plugin Slug:: related-posts-list-grid-and-slider-all-in-one
Installations: 80+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-31569

Plugin:: Terms Before Download
Plugin Slug:: terms-before-download
Installations: 80+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31614

Plugin:: Ultimate Push Notifications ( Mobile / Desktop ), Receive Notification From WooCommerce, BuddyPress, WordPress Default Events & Many More
Plugin Slug:: ultimate-push-notifications
Installations: 80+
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-31561

Plugin:: Varnish WordPress
Plugin Slug:: varnish-wp
Installations: 80+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-31616

Plugin:: PostmarkApp Email Integrator
Plugin Slug:: postmarkapp-email-integrator
Installations: 70+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-31617

Plugin:: PostmarkApp Email Integrator
Plugin Slug:: postmarkapp-email-integrator
Installations: 70+
Vulnerability:: Broken Access Control
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31576

Plugin:: Rich Text Editor
Plugin Slug:: richtexteditor
Installations: 70+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-31623

Plugin:: Simple Contact Forms
Plugin Slug:: simple-contact-forms
Installations: 70+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-31615

Plugin:: Actionwear products sync
Plugin Slug:: actionwear-products-sync
Installations: 60+
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-31619

Plugin:: Infusionsoft Web Form JavaScript
Plugin Slug:: infusionsoft-web-form-javascript
Installations: 60+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31629

Plugin:: Processing Projects
Plugin Slug:: processing-projects
Installations: 60+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31624

Plugin:: Useinfluence
Plugin Slug:: useinfluence
Installations: 60+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-31625

Plugin:: Chat by Chatwee
Plugin Slug:: chatwee
Installations: 50+
Vulnerability:: Broken Access Control
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31596

Plugin:: DesignO
Plugin Slug:: designo
Installations: 50+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31600

Plugin:: Notification Bar, Sticky Notification Bar, Sticky Welcome Bar for any theme
Plugin Slug:: gp-notification-bar
Installations: 50+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31610

Plugin:: Salesmate Add-On for Gravity Forms
Plugin Slug:: gf-salesmate-add-on
Installations: 40+
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2025-31551

Plugin:: Salesmate Add-On for Gravity Forms
Plugin Slug:: gf-salesmate-add-on
Installations: 40+
Vulnerability:: Broken Access Control
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31533

Plugin:: Ethiopian Calendar
Plugin Slug:: ethiopian-calendar
Installations: 10+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31589

Plugin:: AdSense Privacy Policy
Plugin Slug:: adsense-privacy-policy
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-30578

Plugin:: Advanced Dewplayer
Plugin Slug:: advanced-dewplayer
Vulnerability:: Broken Access Control
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-30592

Plugin:: Advanced Post Search
Plugin Slug:: advanced-post-search
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-30548

Plugin:: AI Preloader
Plugin Slug:: ai-preloader
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-30530

Plugin:: Alert Box Block – Display notice/alerts in the front end
Plugin Slug:: alert-box-block
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-13731

Plugin:: AlphaOmega Captcha & Anti-Spam Filter
Plugin Slug:: alphaomega-captcha-anti-spam
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-30584

Plugin:: Amazing service box Addons For WPBakery Page Builder
Plugin Slug:: amazing-service-box-visual-composer-addons
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-2573

Plugin:: ANAC XML Render
Plugin Slug:: anac-xml-render
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-30558

Plugin:: Arrow Maps
Plugin Slug:: ap-google-maps
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-28858

Plugin:: AppExperts
Plugin Slug:: appexperts
Vulnerability:: Sensitive Data Exposure
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-30609

Plugin:: ARPrice
Plugin Slug:: arprice
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-26731

Plugin:: Auto Load Next Post
Plugin Slug:: auto-load-next-post
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-30529

Plugin:: AvaiBook
Plugin Slug:: avaibook
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-30540

Plugin:: Awesome Logos
Plugin Slug:: awesome-logos
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2025-30528

Plugin:: Ayyash Studio
Plugin Slug:: ayyash-studio
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-2576

Plugin:: banner-manager
Plugin Slug:: banner-manager
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-30565

Plugin:: Beautiful Link Preview
Plugin Slug:: beautiful-link-preview
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-30536

Plugin:: Blue Captcha
Plugin Slug:: blue-captcha
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-28880

Plugin:: BMo Expo
Plugin Slug:: bmo-expo
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-30539

Plugin:: Breezing Forms
Plugin Slug:: breezing-forms
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-30520

Plugin:: Browser Address Bar Color
Plugin Slug:: browser-address-bar-color
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-30577

Plugin:: Browser Caching with .htaccess
Plugin Slug:: browser-caching-with-htaccess
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31439

Plugin:: Cackle
Plugin Slug:: cackle
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-30546

Plugin:: CallPhone’r
Plugin Slug:: callphoner
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-30550

Plugin:: CAS Maestro
Plugin Slug:: cas-maestro
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-30561

Plugin:: Cazamba
Plugin Slug:: cazamba
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-25100

Plugin:: Contact Form 7 Material Design
Plugin Slug:: cf7-material-design
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-30522

Plugin:: Clear Sucuri Cache
Plugin Slug:: clear-sucuri-cache
Vulnerability:: Broken Access Control
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31469

Plugin:: Clink
Plugin Slug:: clink
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-30566

Plugin:: CopyLink
Plugin Slug:: copy-link
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-30603

Plugin:: Menu Duplicator
Plugin Slug:: copy-menu
Vulnerability:: Broken Access Control
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-30543

Plugin:: CSV to Responsive Tables
Plugin Slug:: csv-to-webpage-plugin
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-56012

Plugin:: cTabs
Plugin Slug:: ctabs
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-30586

Plugin:: Custom Product Stickers for Woocommerce
Plugin Slug:: custom-product-stickers-for-woocommerce
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-28889

Plugin:: Custom Script Integration
Plugin Slug:: custom-script-integration
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-30564

Plugin:: DAP to Autoresponders Email Syncing
Plugin Slug:: dap-to-autoresponders-daar
Vulnerability:: Sensitive Data Exposure
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-2840

Plugin:: Driving Directions
Plugin Slug:: ddirections
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-28903

Plugin:: DesignThemes Core Features
Plugin Slug:: designthemes-core-features
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-0845

Plugin:: Product Catalog
Plugin Slug:: displayproduct
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2025-30524

Plugin:: ????? ???? ??????? ????
Plugin Slug:: dokme
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-30570

Plugin:: Multi Days Events and Multi Events in One Day Calendar
Plugin Slug:: dragon-calendar-free-version
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31572

Plugin:: Duplicate Page and Post
Plugin Slug:: duplicate-post-and-page
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-31466

Plugin:: Duplicate Page and Post
Plugin Slug:: duplicate-post-and-page
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31471

Plugin:: Easy Page Transition
Plugin Slug:: easy-page-transition
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-30606

Plugin:: Exit Popup Free
Plugin Slug:: exit-popup-free
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31591

Plugin:: External image replace
Plugin Slug:: external-image-replace
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-30535

Plugin:: Secret Meta
Plugin Slug:: facebook-secret-meta
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-25086

Plugin:: Fiverr.com Official Search Box
Plugin Slug:: fiverr-official-search-box
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-28885

Plugin:: Fix Rss Feeds
Plugin Slug:: fix-rss-feed
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-30556

Plugin:: Flatty
Plugin Slug:: flatty-flat-admin-theme
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31472

Plugin:: Flickr set slideshows
Plugin Slug:: flickr-set-slideshows
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-30589

Plugin:: Flickr set slideshows
Plugin Slug:: flickr-set-slideshows
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-30590

Plugin:: Frndzk Expandable Bottom Bar
Plugin Slug:: frndzk-expandable-bottom-bar
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-2510

Plugin:: Generate Post Thumbnails
Plugin Slug:: generate-post-thumbnails
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-30585

Plugin:: GMO Font Agent
Plugin Slug:: gmo-font-agent
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-30553

Plugin:: Google Font Fix
Plugin Slug:: google-font-fix
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-30614

Plugin:: GP Back To Top
Plugin Slug:: gp-back-to-top
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-30521

Plugin:: Hacklog Remote Image Autosave
Plugin Slug:: hacklog-remote-image-autosave
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-30576

Plugin:: IG Shortcodes
Plugin Slug:: ig-shortcodes
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-30597

Plugin:: Image Captcha
Plugin Slug:: image-captcha
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-30534

Plugin:: Image Slider / Slideshow Pearlbells
Plugin Slug:: image-slider-pearlbells
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-56012

Plugin:: Photo Slideshow (Responsive)
Plugin Slug:: image-slideshow-pearlbells
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-56012

Plugin:: include-file
Plugin Slug:: include-file
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-30595

Plugin:: Include URL
Plugin Slug:: include-url
Vulnerability:: Arbitrary File Download
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-30594

Plugin:: Include URL
Plugin Slug:: include-url
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-30593

Plugin:: Info Boxes Shortcode and Widget
Plugin Slug:: info-boxes-shortcode-and-widget
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-30541

Plugin:: issuuPress
Plugin Slug:: issuupress
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-30545

Plugin:: JiangQie Official Website Mini Program
Plugin Slug:: jiangqie-official-website-mini-program
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-30604

Plugin:: jQuery Dropdown Menu
Plugin Slug:: jquery-drop-down-menu-plugin
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-30560

Plugin:: Kento WordPress Stats
Plugin Slug:: kento-wp-stats
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-30559

Plugin:: Key4ce osTicket Bridge
Plugin Slug:: key4ce-osticket-bridge
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-28877

Plugin:: KK I Like It
Plugin Slug:: kk-i-like-it
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-31443

Plugin:: LH OGP Meta
Plugin Slug:: lh-ogp-meta-tags
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-30587

Plugin:: Lightview Plus
Plugin Slug:: lightview-plus
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-28890

Plugin:: Login Alert
Plugin Slug:: login-alert
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-31459

Plugin:: Login Redirect
Plugin Slug:: login-redirect
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-30575

Plugin:: LWS SMS
Plugin Slug:: lws-sms
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31457

Plugin:: Map Contact
Plugin Slug:: map-contact
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-30588

Plugin:: Message ticker
Plugin Slug:: message-ticker
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-30533

Plugin:: Microblog Poster
Plugin Slug:: microblog-poster
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-31435

Plugin:: Mobile Navigation
Plugin Slug:: mobile-navigation
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-30574

Plugin:: Music Press Pro
Plugin Slug:: music-press-pro
Vulnerability:: Broken Access Control
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-30591

Plugin:: My Bootstrap Menu
Plugin Slug:: my-bootstrap-menu
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-30527

Plugin:: My Default Post Content
Plugin Slug:: my-default-post-content
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-30573

Plugin:: NanoSupport
Plugin Slug:: nanosupport
Vulnerability:: Broken Access Control
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31376

Plugin:: NertWorks All in One Social Share Tools
Plugin Slug:: nertworks-all-in-one-social-share-tools
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31447

Plugin:: NextGEN Gallery Voting
Plugin Slug:: nextgen-gallery-voting
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-28869

Plugin:: Nmedia MailChimp
Plugin Slug:: nmedia-mailchimp-widget
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-30613

Plugin:: Easy 301 Redirects
Plugin Slug:: odihost-easy-redirect-301
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-30557

Plugin:: OK Poster Group
Plugin Slug:: ok-poster-group
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-30544

Plugin:: Omnify
Plugin Slug:: omnify-widget
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-28882

Plugin:: OmniLeads Scripts and Tags Manager
Plugin Slug:: omnileads-scripts-and-tags-manager
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-31460

Plugin:: OSS Upload
Plugin Slug:: oss-upload
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-30598

Plugin:: Page Takeover
Plugin Slug:: page-takeover
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31470

Plugin:: Pesapal Gateway for Woocommerce
Plugin Slug:: pesapal-for-woocommerce
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-30579

Plugin:: Pop-Up Chop Chop
Plugin Slug:: pop-up
Vulnerability:: Local File Inclusion
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-31432

Plugin:: PostMash
Plugin Slug:: postmash-custom
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2025-30622

Plugin:: Pretty file links
Plugin Slug:: pretty-file-links
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-30551

Plugin:: Pro Rank Tracker
Plugin Slug:: proranktracker
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-30583

Plugin:: Quick Localization
Plugin Slug:: quick-localization
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-30607

Plugin:: Related Posts via Categories
Plugin Slug:: related-posts-via-categories
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-30602

Plugin:: Replace Default Words
Plugin Slug:: replace-default-words
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-30612

Plugin:: Rewrite
Plugin Slug:: rewrite
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-30617

Plugin:: RJ Quickcharts
Plugin Slug:: rj-quickcharts
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-31024

Plugin:: SH Email Alert
Plugin Slug:: sh-email-alert
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-2165

Plugin:: ShowTime Slideshow
Plugin Slug:: showtime-slideshow
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-31444

Plugin:: Shuffle
Plugin Slug:: shuffle
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-28873

Plugin:: Simple Optimizer
Plugin Slug:: simple-optimizer
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-30538

Plugin:: Simple Rating
Plugin Slug:: simple-rating
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-30572

Plugin:: Simple Trackback Disabler
Plugin Slug:: simple-trackback-disabler
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31448

Plugin:: Simple:Press
Plugin Slug:: simplepress
Vulnerability:: Broken Access Control
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31386

Plugin:: Smart Maintenance Mode
Plugin Slug:: smart-maintenance-mode
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-1490

Plugin:: So-Called Air Quotes
Plugin Slug:: so-called-air-quotes
Vulnerability:: Content Injection
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-2803

Plugin:: SoJ SoundSlides
Plugin Slug:: soj-soundslides
Vulnerability:: Arbitrary File Upload
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-2249

Plugin:: SoundCloud Ultimate
Plugin Slug:: soundcloud-ultimate
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-30542

Plugin:: sourceplay-navermap
Plugin Slug:: sourceplay-navermap
Vulnerability:: Broken Access Control
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-30605

Plugin:: SpeakPipe
Plugin Slug:: speakpipe-voicemail-for-websites
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-30619

Plugin:: STEdb Forms
Plugin Slug:: stedb-forms
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-30571

Plugin:: Super Simple Subscriptions
Plugin Slug:: super-simple-subscriptions
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-30523

Plugin:: Super Static Cache
Plugin Slug:: super-static-cache
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-30568

Plugin:: Teleport
Plugin Slug:: teleport
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-28855

Plugin:: Terms of Use
Plugin Slug:: terms-of-use-2
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-31440

Plugin:: Text Selection Color
Plugin Slug:: text-selection-color
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31464

Plugin:: The Visitor Counter
Plugin Slug:: the-visitor-counter
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-31449

Plugin:: Tidekey
Plugin Slug:: tidekey
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-30563

Plugin:: Toggle Box
Plugin Slug:: toggle-box
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31450

Plugin:: Trackserver
Plugin Slug:: trackserver
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-30961

Plugin:: Translator
Plugin Slug:: translator
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-30621

Plugin:: Typekit plugin for WordPress
Plugin Slug:: typekit
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-30526

Plugin:: Top Bar
Plugin Slug:: ultimate-bar
Vulnerability:: Broken Access Control
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-30581

Plugin:: Ultimate Security Checker
Plugin Slug:: ultimate-security-checker
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31456

Plugin:: Upload Quota per User
Plugin Slug:: upload-quota-per-user
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-30537

Plugin:: Video Embedder
Plugin Slug:: video-embedder
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-31458

Plugin:: Visual Text Editor
Plugin Slug:: visual-text-editor
Vulnerability:: Remote Code Execution (RCE)
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2025-28893

Plugin:: wA11y – The Web Accessibility Toolbox
Plugin Slug:: wa11y
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-30623

Plugin:: wBounce
Plugin Slug:: wbounce
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31451

Plugin:: Weather Layer
Plugin Slug:: weather-layer
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-30532

Plugin:: WordPress Admin Bar Improved
Plugin Slug:: wordpress-admin-bar-improved
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-30552

Plugin:: WordPress SQL Backup
Plugin Slug:: wordpress-sql-backup
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-30608

Plugin:: WP Cards
Plugin Slug:: wp-cards
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-30547

Plugin:: WP Church Donation
Plugin Slug:: wp-church-donation
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31410

Plugin:: WP Colorful Tag Cloud
Plugin Slug:: wp-colorful-tag-cloud
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-28865

Plugin:: WP Database Optimizer
Plugin Slug:: wp-database-optimizer
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31473

Plugin:: WP Database Optimizer
Plugin Slug:: wp-database-optimizer
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31474

Plugin:: WP e-Commerce Style Email
Plugin Slug:: wp-e-commerce-style-email
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2025-30615

Plugin:: Magic Embeds
Plugin Slug:: wp-embed-facebook
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31433

Plugin:: WP Featured Entries
Plugin Slug:: wp-featured-entries
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-30569

Plugin:: WP Hotjar
Plugin Slug:: wp-hotjar
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-30600

Plugin:: Job Colors for WP Job Manager
Plugin Slug:: wp-job-manager-colors
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31031

Plugin:: WP Multistore Locator
Plugin Slug:: wp-multi-store-locator
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2025-28898

Plugin:: WP Odoo Form Integrator
Plugin Slug:: wp-odoo-form-integrator
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-30620

Plugin:: WP-OGP
Plugin Slug:: wp-ogp
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31437

Plugin:: WP Parallax Content Slider
Plugin Slug:: wp-parallax-content-slider
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-30599

Plugin:: VaultRE Contact Form 7
Plugin Slug:: wp-plugin-contact-form-7
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31101

Plugin:: WP Profitshare
Plugin Slug:: wp-profitshare
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-30525

Plugin:: WP Ride Booking
Plugin Slug:: wp-ride-booking
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-30531

Plugin:: WP Social Widget
Plugin Slug:: wp-social-widget
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-30610

Plugin:: WP Supersized
Plugin Slug:: wp-supersized
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31438

Plugin:: WP Ultimate Search
Plugin Slug:: wp-ultimate-search
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31452

Plugin:: WP01
Plugin Slug:: wp01
Vulnerability:: Arbitrary File Download
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-30567

Plugin:: WordPres ????
Plugin Slug:: wp2wb
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-30555

Plugin:: WP Event Ticketing
Plugin Slug:: wpeventticketing
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-28899

Plugin:: XV Random Quotes
Plugin Slug:: xv-random-quotes
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2025-30971

Plugin:: YouTube SimpleGallery
Plugin Slug:: youtube-simplegallery
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31453

Plugin:: Yummly Rich Recipes
Plugin Slug:: yummly-rich-recipes
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-30549

Plugin:: WordPress Importer
Plugin Slug:: wordpress-importer
Installations: 3,000,000+
Vulnerability:: PHP Object Injection
Patched in Version:: 0.8.4
Severity Score:: High
CVE:: 2024-13889

Plugin:: ElementsKit Elementor Addons and Templates
Plugin Slug:: elementskit-lite
Installations: 1,000,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.4.8
Severity Score:: Medium
CVE:: 2024-11180

Plugin:: Spectra Gutenberg Blocks – Website Builder for the Block Editor
Plugin Slug:: ultimate-addons-for-gutenberg
Installations: 1,000,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.19.1
Severity Score:: Medium
CVE:: 2025-1784

Plugin:: Smush Image Optimization – Optimize Images | Compress & Lazy Load Images | Convert WebP & AVIF | Image CDN
Plugin Slug:: wp-smushit
Installations: 1,000,000+
Vulnerability:: Directory Traversal
Patched in Version:: 3.17.1
Severity Score:: Medium
CVE:: 2025-22288

Plugin:: TablePress – Tables in WordPress made easy
Plugin Slug:: tablepress
Installations: 700,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.1
Severity Score:: Medium
CVE:: 2025-2685

Plugin:: Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider
Plugin Slug:: ml-slider
Installations: 600,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.95.0
Severity Score:: Medium
CVE:: 2025-1062

Plugin:: MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor
Plugin Slug:: metform
Installations: 500,000+
Vulnerability:: Server Side Request Forgery (SSRF)
Patched in Version:: 3.9.3
Severity Score:: Medium
CVE:: 2025-30914

Plugin:: Happy Addons for Elementor
Plugin Slug:: happy-elementor-addons
Installations: 400,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.16.3
Severity Score:: Medium
CVE:: 2025-30766

Plugin:: GDPR Cookie Compliance – Cookie Banner, Cookie Consent, Cookie Notice – CCPA, DSGVO, RGPD
Plugin Slug:: gdpr-cookie-compliance
Installations: 300,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 4.15.9
Severity Score:: Medium
CVE:: 2025-1623

Plugin:: Translate Multilingual sites – TranslatePress
Plugin Slug:: translatepress-multilingual
Installations: 300,000+
Vulnerability:: PHP Object Injection
Patched in Version:: 2.9.7
Severity Score:: High
CVE:: 2025-30773

Plugin:: Photo Gallery by 10Web – Mobile-Friendly Image Gallery
Plugin Slug:: photo-gallery
Installations: 200,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.8.34
Severity Score:: High
CVE:: 2025-0613

Plugin:: Photo Gallery by 10Web – Mobile-Friendly Image Gallery
Plugin Slug:: photo-gallery
Installations: 200,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.8.33
Severity Score:: Medium
CVE:: 2024-13124

Plugin:: GiveWP – Donation Plugin and Fundraising Platform
Plugin Slug:: give
Installations: 100,000+
Vulnerability:: Broken Access Control
Patched in Version:: 3.22.2
Severity Score:: Medium
CVE:: 2025-2331

Plugin:: Pods – Custom Content Types and Fields
Plugin Slug:: pods
Installations: 100,000+
Vulnerability:: SQL Injection
Patched in Version:: 3.2.8.2
Severity Score:: High
CVE:: 2025-1446

Plugin:: SEO Plugin by Squirrly SEO
Plugin Slug:: squirrly-seo
Installations: 100,000+
Vulnerability:: SQL Injection
Patched in Version:: 12.4.06
Severity Score:: High
CVE:: 2025-22783

Plugin:: The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid
Plugin Slug:: the-post-grid
Installations: 100,000+
Vulnerability:: Local File Inclusion
Patched in Version:: 7.7.18
Severity Score:: High
CVE:: 2025-30814

Plugin:: Event Tickets and Registration
Plugin Slug:: event-tickets
Installations: 90,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 5.20.1
Severity Score:: High
CVE:: 2025-30794

Plugin:: Kubio AI Page Builder
Plugin Slug:: kubio
Installations: 90,000+
Vulnerability:: Local File Inclusion
Patched in Version:: 2.5.2
Severity Score:: Critical
CVE:: 2025-2294

Plugin:: LearnPress – WordPress LMS Plugin
Plugin Slug:: learnpress
Installations: 90,000+
Vulnerability:: Broken Access Control
Patched in Version:: 4.2.7.6
Severity Score:: Medium
CVE:: 2025-22739

Plugin:: PowerPack Elementor Addons (Free Widgets, Extensions and Templates)
Plugin Slug:: powerpack-lite-for-elementor
Installations: 90,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.9.1
Severity Score:: Medium
CVE:: 2025-1512

Plugin:: Product Import Export for WooCommerce – Import Export Product CSV Suite
Plugin Slug:: product-import-export-for-woo
Installations: 90,000+
Vulnerability:: PHP Object Injection
Patched in Version:: 2.5.1
Severity Score:: High
CVE:: 2025-1913

Plugin:: Product Import Export for WooCommerce – Import Export Product CSV Suite
Plugin Slug:: product-import-export-for-woo
Installations: 90,000+
Vulnerability:: Server Side Request Forgery (SSRF)
Patched in Version:: 2.5.1
Severity Score:: Medium
CVE:: 2025-1912

Plugin:: Product Import Export for WooCommerce – Import Export Product CSV Suite
Plugin Slug:: product-import-export-for-woo
Installations: 90,000+
Vulnerability:: Directory Traversal
Patched in Version:: 2.5.1
Severity Score:: Medium
CVE:: 2025-1769

Plugin:: Nested Pages
Plugin Slug:: wp-nested-pages
Installations: 90,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.2.13
Severity Score:: Medium
CVE:: 2025-0718

Plugin:: Booking for Appointments and Events Calendar – Amelia
Plugin Slug:: ameliabooking
Installations: 80,000+
Vulnerability:: Full Path Disclosure (FPD)
Patched in Version:: 1.2.20
Severity Score:: Medium
CVE:: 2025-2578

Plugin:: Advanced Woo Search
Plugin Slug:: advanced-woo-search
Installations: 70,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.29
Severity Score:: Medium
CVE:: 2025-2302

Plugin:: Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid
Plugin Slug:: boldgrid-backup
Installations: 70,000+
Vulnerability:: Remote Code Execution (RCE)
Patched in Version:: 1.17.0
Severity Score:: High
CVE:: 2025-2257

Plugin:: Media Library Assistant
Plugin Slug:: media-library-assistant
Installations: 70,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.25
Severity Score:: Medium
CVE:: 2025-31627

Plugin:: Drag and Drop Multiple File Upload for Contact Form 7
Plugin Slug:: drag-and-drop-multiple-file-upload-contact-form-7
Installations: 60,000+
Vulnerability:: PHP Object Injection
Patched in Version:: 1.3.8.8
Severity Score:: Critical
CVE:: 2025-2485

Plugin:: Drag and Drop Multiple File Upload for Contact Form 7
Plugin Slug:: drag-and-drop-multiple-file-upload-contact-form-7
Installations: 60,000+
Vulnerability:: Arbitrary File Deletion
Patched in Version:: 1.3.8.8
Severity Score:: High
CVE:: 2025-2328

Plugin:: Ultimate Dashboard – Custom WordPress Dashboard
Plugin Slug:: ultimate-dashboard
Installations: 60,000+
Vulnerability:: Broken Access Control
Patched in Version:: 3.8.8
Severity Score:: Medium
CVE:: 2025-2276

Plugin:: User Registration & Membership – Custom Registration Form, Login Form, and User Profile
Plugin Slug:: user-registration
Installations: 60,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 4.0.4
Severity Score:: Medium
CVE:: 2025-30899

Plugin:: User Registration & Membership – Custom Registration Form, Login Form, and User Profile
Plugin Slug:: user-registration
Installations: 60,000+
Vulnerability:: Privilege Escalation
Patched in Version:: 4.1.2
Severity Score:: Critical
CVE:: 2025-2563

Plugin:: Export and Import Users and Customers
Plugin Slug:: users-customers-import-export-for-wp-woocommerce
Installations: 60,000+
Vulnerability:: Arbitrary File Download
Patched in Version:: 2.6.3
Severity Score:: Low
CVE:: 2025-1973

Plugin:: Export and Import Users and Customers
Plugin Slug:: users-customers-import-export-for-wp-woocommerce
Installations: 60,000+
Vulnerability:: PHP Object Injection
Patched in Version:: 2.6.3
Severity Score:: High
CVE:: 2025-1971

Plugin:: Export and Import Users and Customers
Plugin Slug:: users-customers-import-export-for-wp-woocommerce
Installations: 60,000+
Vulnerability:: Arbitrary File Deletion
Patched in Version:: 2.6.3
Severity Score:: Low
CVE:: 2025-1972

Plugin:: Export and Import Users and Customers
Plugin Slug:: users-customers-import-export-for-wp-woocommerce
Installations: 60,000+
Vulnerability:: Server Side Request Forgery (SSRF)
Patched in Version:: 2.6.3
Severity Score:: Medium
CVE:: 2025-1970

Plugin:: Advanced iFrame
Plugin Slug:: advanced-iframe
Installations: 50,000+
Vulnerability:: Broken Access Control
Patched in Version:: 2025.0
Severity Score:: Medium
CVE:: 2025-1440

Plugin:: Advanced iFrame
Plugin Slug:: advanced-iframe
Installations: 50,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2025.0
Severity Score:: Medium
CVE:: 2025-1437

Plugin:: Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
Plugin Slug:: easy-digital-downloads
Installations: 50,000+
Vulnerability:: Sensitive Data Exposure
Patched in Version:: 3.3.7
Severity Score:: Medium
CVE:: 2025-2252

Plugin:: Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
Plugin Slug:: form-maker
Installations: 50,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.15.30
Severity Score:: Medium
CVE:: 2024-10558

Plugin:: Simple Banner – Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website
Plugin Slug:: simple-banner
Installations: 50,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.0.4
Severity Score:: Medium
CVE:: 2024-12769

Plugin:: Structured Content (JSON-LD) #wpsc
Plugin Slug:: structured-content
Installations: 50,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.6.4
Severity Score:: Medium
CVE:: 2025-30918

Plugin:: Ultimate Blocks – WordPress Blocks Plugin
Plugin Slug:: ultimate-blocks
Installations: 50,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.2.8
Severity Score:: Medium
CVE:: 2025-31077

Plugin:: Zapier for WordPress
Plugin Slug:: zapier
Installations: 50,000+
Vulnerability:: Server Side Request Forgery (SSRF)
Patched in Version:: 1.5.2
Severity Score:: Medium
CVE:: 2024-13411

Plugin:: Greenshift – animation and page builder blocks
Plugin Slug:: greenshift-animation-and-page-builder-blocks
Installations: 40,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 11.1
Severity Score:: Medium
CVE:: 2025-30873

Plugin:: Contact Form & SMTP Plugin for WordPress by PirateForms
Plugin Slug:: pirate-forms
Installations: 40,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.6.0
Severity Score:: Medium
CVE:: 2024-11272

Plugin:: Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker
Plugin Slug:: quiz-master-next
Installations: 40,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 9.2.1
Severity Score:: Medium
CVE:: 2024-10679

Plugin:: SecuPress Free — WordPress Security
Plugin Slug:: secupress
Installations: 40,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.2.5.4
Severity Score:: Medium
CVE:: 2025-30907

Plugin:: Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX
Plugin Slug:: ultimate-post
Installations: 40,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 4.1.26
Severity Score:: Medium
CVE:: 2025-31096

Plugin:: Booster for WooCommerce
Plugin Slug:: woocommerce-jetpack
Installations: 40,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 7.2.6
Severity Score:: High
CVE:: 2024-12278

Plugin:: Cost Calculator Builder
Plugin Slug:: cost-calculator-builder
Installations: 30,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.2.66
Severity Score:: Medium
CVE:: 2025-31414

Plugin:: Float menu – awesome floating side menu
Plugin Slug:: float-menu
Installations: 30,000+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: 6.1.3
Severity Score:: Medium
CVE:: 2025-30912

Plugin:: LeadConnector
Plugin Slug:: leadconnector
Installations: 30,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.0.3
Severity Score:: Medium
CVE:: 2025-30893

Plugin:: Ads by WPQuads – Adsense Ads, Banner Ads, Popup Ads
Plugin Slug:: quick-adsense-reloaded
Installations: 30,000+
Vulnerability:: Broken Access Control
Patched in Version:: 2.0.88
Severity Score:: High
CVE:: 2025-30855

Plugin:: Ads by WPQuads – Adsense Ads, Banner Ads, Popup Ads
Plugin Slug:: quick-adsense-reloaded
Installations: 30,000+
Vulnerability:: SQL Injection
Patched in Version:: 2.0.88
Severity Score:: Critical
CVE:: 2025-30876

Plugin:: RomethemeKit For Elementor
Plugin Slug:: rometheme-for-elementor
Installations: 30,000+
Vulnerability:: Remote Code Execution (RCE)
Patched in Version:: 1.5.5
Severity Score:: Critical
CVE:: 2025-30911

Plugin:: Analytify – Google Analytics Dashboard For WordPress (GA4 analytics made easy)
Plugin Slug:: wp-analytify
Installations: 30,000+
Vulnerability:: Settings Change
Patched in Version:: 6.0.0
Severity Score:: Medium
CVE:: 2025-30897

Plugin:: WP Google Review Slider
Plugin Slug:: wp-google-places-review-slider
Installations: 30,000+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: 16.1
Severity Score:: High
CVE:: 2025-30783

Plugin:: Conversios: Google Analytics GA4, Google Ads, GTM & Multiple Pixel Tracking
Plugin Slug:: enhanced-e-commerce-for-woocommerce-store
Installations: 20,000+
Vulnerability:: Broken Access Control
Patched in Version:: 7.2.4
Severity Score:: Medium
CVE:: 2025-30909

Plugin:: Gum Elementor Addon
Plugin Slug:: gum-elementor-addon
Installations: 20,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.3.11
Severity Score:: Medium
CVE:: 2025-30800

Plugin:: InstaWP Connect – 1-click WP Staging & Migration
Plugin Slug:: instawp-connect
Installations: 20,000+
Vulnerability:: Local File Inclusion
Patched in Version:: 0.1.0.83
Severity Score:: High
CVE:: 2025-31387

Plugin:: King Addons for Elementor – Free Elements, Widgets, Templates, and Features for Elementor
Plugin Slug:: king-addons
Installations: 20,000+
Vulnerability:: Broken Access Control
Patched in Version:: 24.12.59
Severity Score:: Medium
CVE:: 2025-30926

Plugin:: ?????? ??? ? ??? ??????? (??? ?????? ? ??????? ??? ??????)
Plugin Slug:: persian-woocommerce-shipping
Installations: 20,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 4.2.4
Severity Score:: Medium
CVE:: 2025-30898

Plugin:: Quiz Maker
Plugin Slug:: quiz-maker
Installations: 20,000+
Vulnerability:: SQL Injection
Patched in Version:: 6.6.8.8
Severity Score:: High
CVE:: 2025-30774

Plugin:: Slider by 10Web – Responsive Image Slider
Plugin Slug:: slider-wd
Installations: 20,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.2.62
Severity Score:: Medium
CVE:: 2024-10566

Plugin:: Slider by 10Web – Responsive Image Slider
Plugin Slug:: slider-wd
Installations: 20,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.2.62
Severity Score:: Medium
CVE:: 2024-10565

Plugin:: SyntaxHighlighter Evolved
Plugin Slug:: syntaxhighlighter
Installations: 20,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.7.2
Severity Score:: Medium
CVE:: 2025-30903

Plugin:: FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce
Plugin Slug:: wp-marketing-automations
Installations: 20,000+
Vulnerability:: Open Redirection
Patched in Version:: 3.5.2
Severity Score:: Medium
CVE:: 2025-30795

Plugin:: FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce
Plugin Slug:: wp-marketing-automations
Installations: 20,000+
Vulnerability:: SQL Injection
Patched in Version:: 3.5.2
Severity Score:: Critical
CVE:: 2025-2186

Plugin:: WP Travel Engine – Tour Booking Plugin – Tour Operator Software
Plugin Slug:: wp-travel-engine
Installations: 20,000+
Vulnerability:: Local File Inclusion
Patched in Version:: 6.3.6
Severity Score:: High
CVE:: 2025-30870

Plugin:: WP Travel Engine – Tour Booking Plugin – Tour Operator Software
Plugin Slug:: wp-travel-engine
Installations: 20,000+
Vulnerability:: Local File Inclusion
Patched in Version:: 6.3.6
Severity Score:: High
CVE:: 2025-30871

Plugin:: Import Export Suite for CSV and XML Datafeed
Plugin Slug:: wp-ultimate-csv-importer
Installations: 20,000+
Vulnerability:: Arbitrary File Upload
Patched in Version:: 7.19.1
Severity Score:: High
CVE:: 2025-2008

Plugin:: Import Export Suite for CSV and XML Datafeed
Plugin Slug:: wp-ultimate-csv-importer
Installations: 20,000+
Vulnerability:: Arbitrary File Deletion
Patched in Version:: 7.19.1
Severity Score:: High
CVE:: 2025-2007

Plugin:: Product Labels For Woocommerce (Sale Badges)
Plugin Slug:: aco-product-labels-for-woocommerce
Installations: 10,000+
Vulnerability:: SQL Injection
Patched in Version:: 1.5.9
Severity Score:: High
CVE:: 2024-12109

Plugin:: Product Labels For Woocommerce (Sale Badges)
Plugin Slug:: aco-product-labels-for-woocommerce
Installations: 10,000+
Vulnerability:: SQL Injection
Patched in Version:: 1.5.11
Severity Score:: High
CVE:: 2024-10638

Plugin:: AFI – The Easiest Integration Plugin
Plugin Slug:: advanced-form-integration
Installations: 10,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.100.0
Severity Score:: Medium
CVE:: 2024-13122

Plugin:: Webhook Automator & Contact Form Integration to Automate 280+ Platforms – Bit Integrations
Plugin Slug:: bit-integrations
Installations: 10,000+
Vulnerability:: Open Redirection
Patched in Version:: 2.5.0
Severity Score:: Medium
CVE:: 2025-30884

Plugin:: Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More
Plugin Slug:: charitable
Installations: 10,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.8.4.8
Severity Score:: Medium
CVE:: 2025-30770

Plugin:: Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings
Plugin Slug:: directorist
Installations: 10,000+
Vulnerability:: Broken Access Control
Patched in Version:: 8.3
Severity Score:: Medium
CVE:: 2025-2224

Plugin:: Favorites
Plugin Slug:: favorites
Installations: 10,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.3.5
Severity Score:: Medium
CVE:: 2025-1452

Plugin:: Social Reviews & Recommendations
Plugin Slug:: fb-reviews-widget
Installations: 10,000+
Vulnerability:: Broken Access Control
Patched in Version:: 2.4
Severity Score:: Medium
CVE:: 2025-30883

Plugin:: Job Postings
Plugin Slug:: job-postings
Installations: 10,000+
Vulnerability:: Arbitrary File Download
Patched in Version:: 2.7.12
Severity Score:: Medium
CVE:: 2025-1310

Plugin:: Job Postings
Plugin Slug:: job-postings
Installations: 10,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.7.11
Severity Score:: Medium
CVE:: 2024-10105

Plugin:: LatePoint – Calendar Booking Plugin for Appointments and Events
Plugin Slug:: latepoint
Installations: 10,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 5.1.7
Severity Score:: Medium
CVE:: 2025-30836

Plugin:: Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
Plugin Slug:: paid-member-subscriptions
Installations: 10,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.14.4
Severity Score:: Medium
CVE:: 2025-31088

Plugin:: Five Star Restaurant Reservations – WordPress Booking Plugin
Plugin Slug:: restaurant-reservations
Installations: 10,000+
Vulnerability:: Broken Access Control
Patched in Version:: 2.6.30
Severity Score:: Medium
CVE:: 2025-30861

Plugin:: Sensei LMS – Online Courses, Quizzes, & Learning
Plugin Slug:: sensei-lms
Installations: 10,000+
Vulnerability:: Broken Access Control
Patched in Version:: 4.24.5
Severity Score:: Medium
CVE:: 2025-22740

Plugin:: WP Date and Time Shortcode
Plugin Slug:: wp-date-and-time-shortcode
Installations: 10,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.6.8
Severity Score:: Medium
CVE:: 2025-31590

Plugin:: WP Tabs – Responsive Tabs and Custom Product Tabs
Plugin Slug:: wp-expand-tabs-free
Installations: 10,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.2.7
Severity Score:: Medium
CVE:: 2024-11503

Plugin:: ?=== Export All Posts, Products, Orders, Refunds & Users
Plugin Slug:: wp-ultimate-exporter
Installations: 10,000+
Vulnerability:: PHP Object Injection
Patched in Version:: 2.14
Severity Score:: Critical
CVE:: 2025-2332

Plugin:: Chat Widget: Customer Support Button with SMS Call Button, Click to Chat Messenger, Live Chat Support Chat Button – Bit Assist
Plugin Slug:: bit-assist
Installations: 9,000+
Vulnerability:: Path Traversal
Patched in Version:: 1.5.5
Severity Score:: High
CVE:: 2025-30834

Plugin:: Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder
Plugin Slug:: bit-form
Installations: 9,000+
Vulnerability:: Open Redirection
Patched in Version:: 2.18.1
Severity Score:: Medium
CVE:: 2025-30885

Plugin:: Essential Real Estate
Plugin Slug:: essential-real-estate
Installations: 9,000+
Vulnerability:: Local File Inclusion
Patched in Version:: 5.2.1
Severity Score:: High
CVE:: 2025-30849

Plugin:: Registrations for the Events Calendar – Event Registration Plugin
Plugin Slug:: registrations-for-the-events-calendar
Installations: 9,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.13.4
Severity Score:: Medium
CVE:: 2024-10703

Plugin:: WP Compress – Instant Performance & Speed Optimization
Plugin Slug:: wp-compress-image-optimizer
Installations: 9,000+
Vulnerability:: Broken Access Control
Patched in Version:: 6.30.16
Severity Score:: High
CVE:: 2025-2110

Plugin:: WP Compress – Instant Performance & Speed Optimization
Plugin Slug:: wp-compress-image-optimizer
Installations: 9,000+
Vulnerability:: Server Side Request Forgery (SSRF)
Patched in Version:: 6.30.16
Severity Score:: Medium
CVE:: 2025-2109

Plugin:: Awesome Support – WordPress HelpDesk & Support Plugin
Plugin Slug:: awesome-support
Installations: 8,000+
Vulnerability:: Sensitive Data Exposure
Patched in Version:: 6.3.2
Severity Score:: High
CVE:: 2024-13567

Plugin:: Cozy Blocks – Page Builder for Gutenberg & Site Editor with Post Blocks, WooCommerce Blocks, Magazine Blocks & WordPress Gutenberg Blocks
Plugin Slug:: cozy-addons
Installations: 8,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.1.7
Severity Score:: Medium
CVE:: 2025-30838

Plugin:: Event Manager and Tickets Selling Plugin for WooCommerce – WpEvently – WordPress Plugin
Plugin Slug:: mage-eventpress
Installations: 8,000+
Vulnerability:: Local File Inclusion
Patched in Version:: 4.3.0
Severity Score:: High
CVE:: 2025-30895

Plugin:: Event Manager and Tickets Selling Plugin for WooCommerce – WpEvently – WordPress Plugin
Plugin Slug:: mage-eventpress
Installations: 8,000+
Vulnerability:: Broken Access Control
Patched in Version:: 4.3.0
Severity Score:: Medium
CVE:: 2025-30887

Plugin:: WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting
Plugin Slug:: erp
Installations: 7,000+
Vulnerability:: Broken Access Control
Patched in Version:: 1.14.0
Severity Score:: Medium
CVE:: 2025-30896

Plugin:: JS Help Desk – The Ultimate Help Desk & Support Plugin
Plugin Slug:: js-support-ticket
Installations: 7,000+
Vulnerability:: Broken Access Control
Patched in Version:: 2.9.3
Severity Score:: High
CVE:: 2025-30880

Plugin:: JS Help Desk – The Ultimate Help Desk & Support Plugin
Plugin Slug:: js-support-ticket
Installations: 7,000+
Vulnerability:: SQL Injection
Patched in Version:: 2.9.3
Severity Score:: Critical
CVE:: 2025-30886

Plugin:: JS Help Desk – The Ultimate Help Desk & Support Plugin
Plugin Slug:: js-support-ticket
Installations: 7,000+
Vulnerability:: Arbitrary File Download
Patched in Version:: 2.9.2
Severity Score:: High
CVE:: 2025-30882

Plugin:: JS Help Desk – The Ultimate Help Desk & Support Plugin
Plugin Slug:: js-support-ticket
Installations: 7,000+
Vulnerability:: Arbitrary File Deletion
Patched in Version:: 2.9.3
Severity Score:: High
CVE:: 2025-30878

Plugin:: JS Help Desk – The Ultimate Help Desk & Support Plugin
Plugin Slug:: js-support-ticket
Installations: 7,000+
Vulnerability:: Local File Inclusion
Patched in Version:: 2.9.3
Severity Score:: High
CVE:: 2025-30901

Plugin:: Shipmondo – A complete shipping solution for WooCommerce
Plugin Slug:: pakkelabels-for-woocommerce
Installations: 7,000+
Vulnerability:: Sensitive Data Exposure
Patched in Version:: 5.0.4
Severity Score:: Medium
CVE:: 2025-27001

Plugin:: WooCommerce Wishlist (High customization, fast setup,Free Elementor Wishlist, most features)
Plugin Slug:: smart-wishlist-for-more-convert
Installations: 7,000+
Vulnerability:: SQL Injection
Patched in Version:: 1.9.0
Severity Score:: High
CVE:: 2025-30879

Plugin:: Quiz Cat – WordPress Quiz Plugin
Plugin Slug:: quiz-cat
Installations: 6,000+
Vulnerability:: Broken Access Control
Patched in Version:: 3.0.9
Severity Score:: Low
CVE:: 2025-30877

Plugin:: WPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce
Plugin Slug:: wp-cafe
Installations: 6,000+
Vulnerability:: Local File Inclusion
Patched in Version:: 2.2.32
Severity Score:: High
CVE:: 2025-30829

Plugin:: Audio Album
Plugin Slug:: audio-album
Installations: 5,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.5.1
Severity Score:: Medium
CVE:: 2025-30780

Plugin:: Specific Content For Mobile – Customize the mobile version without redirections
Plugin Slug:: specific-content-for-mobile
Installations: 5,000+
Vulnerability:: Broken Access Control
Patched in Version:: 0.5.4
Severity Score:: Medium
CVE:: 2025-30874

Plugin:: AliExpress Dropshipping Plugin for WooCommerce – AliNext
Plugin Slug:: ali2woo-lite
Installations: 4,000+
Vulnerability:: Open Redirection
Patched in Version:: 3.5.4
Severity Score:: Medium
CVE:: 2025-30859

Plugin:: Doneren met Mollie
Plugin Slug:: doneren-met-mollie
Installations: 4,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.10.8
Severity Score:: Medium
CVE:: 2025-30779

Plugin:: Inline Image Upload for BBPress
Plugin Slug:: image-upload-for-bbpress
Installations: 4,000+
Vulnerability:: Arbitrary File Upload
Patched in Version:: 1.1.20
Severity Score:: High
CVE:: 2025-2006

Plugin:: Stylish Price List – Price Table Builder & QR Code Restaurant Menu
Plugin Slug:: stylish-price-list
Installations: 4,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 7.1.12
Severity Score:: Medium
CVE:: 2024-10472

Plugin:: WP Posts Carousel
Plugin Slug:: wp-posts-carousel
Installations: 4,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.3.9
Severity Score:: Medium
CVE:: 2025-31094

Plugin:: WP Posts Carousel
Plugin Slug:: wp-posts-carousel
Installations: 4,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.3.8
Severity Score:: Medium
CVE:: 2025-30920

Plugin:: Chartify – WordPress Chart Plugin
Plugin Slug:: chart-builder
Installations: 3,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.1.9
Severity Score:: Medium
CVE:: 2025-30904

Plugin:: Restaurant Menu and Food Ordering
Plugin Slug:: mp-restaurant-menu
Installations: 3,000+
Vulnerability:: Local File Inclusion
Patched in Version:: 2.4.5
Severity Score:: High
CVE:: 2025-30846

Plugin:: Newsletters
Plugin Slug:: newsletters-lite
Installations: 3,000+
Vulnerability:: SQL Injection
Patched in Version:: 4.9.9.8
Severity Score:: High
CVE:: 2025-30921

Plugin:: Newsletters
Plugin Slug:: newsletters-lite
Installations: 3,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 4.9.9.8
Severity Score:: High
CVE:: 2025-2009

Plugin:: Themify Event Post
Plugin Slug:: themify-event-post
Installations: 3,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.3.3
Severity Score:: Medium
CVE:: 2025-30832

Plugin:: Themify Event Post
Plugin Slug:: themify-event-post
Installations: 3,000+
Vulnerability:: Local File Inclusion
Patched in Version:: 1.3.3
Severity Score:: High
CVE:: 2025-30831

Plugin:: Tickera – WordPress Event Ticketing
Plugin Slug:: tickera-event-ticketing-system
Installations: 3,000+
Vulnerability:: Broken Access Control
Patched in Version:: 3.5.5.3
Severity Score:: Medium
CVE:: 2025-30851

Plugin:: Vimeotheque: Vimeo WordPress Plugin
Plugin Slug:: codeflavors-vimeo-video-post-lite
Installations: 2,000+
Vulnerability:: SQL Injection
Patched in Version:: 2.3.4.3
Severity Score:: High
CVE:: 2025-30806

Plugin:: WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg
Plugin Slug:: groundhogg
Installations: 2,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 4.0
Severity Score:: Medium
CVE:: 2025-1267

Plugin:: Scheduled & Automatic Order Status Controller for WooCommerce
Plugin Slug:: order-status-rules-for-woocommerce
Installations: 2,000+
Vulnerability:: Open Redirection
Patched in Version:: 3.7.2
Severity Score:: Medium
CVE:: 2025-30781

Plugin:: Active Products Tables for WooCommerce. Use constructor to create tables
Plugin Slug:: profit-products-tables-for-woocommerce
Installations: 2,000+
Vulnerability:: Content Injection
Patched in Version:: 1.0.6.8
Severity Score:: High
CVE:: 2025-1514

Plugin:: Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates
Plugin Slug:: responsive-addons-for-elementor
Installations: 2,000+
Vulnerability:: Sensitive Data Exposure
Patched in Version:: 1.6.9
Severity Score:: Medium
CVE:: 2025-2228

Plugin:: Sitekit
Plugin Slug:: sitekit
Installations: 2,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.9
Severity Score:: Medium
CVE:: 2025-30776

Plugin:: The Pack Elementor addons (Header Footer & WooCommerce Builder, Template Library)
Plugin Slug:: the-pack-addon
Installations: 2,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.1.2
Severity Score:: Medium
CVE:: 2025-30925

Plugin:: The Pack Elementor addons (Header Footer & WooCommerce Builder, Template Library)
Plugin Slug:: the-pack-addon
Installations: 2,000+
Vulnerability:: Local File Inclusion
Patched in Version:: 2.1.2
Severity Score:: High
CVE:: 2025-30845

Plugin:: Appointment Booking and Scheduling Calendar Plugin – WP Timetics
Plugin Slug:: timetics
Installations: 2,000+
Vulnerability:: Broken Access Control
Patched in Version:: 1.0.30
Severity Score:: Medium
CVE:: 2025-30828

Plugin:: Vitepos – Point of sale (POS) plugin for WooCommerce
Plugin Slug:: vitepos-lite
Installations: 2,000+
Vulnerability:: Broken Authentication
Patched in Version:: 3.1.5
Severity Score:: High
CVE:: 2025-22277

Plugin:: WP-Recall – Registration, Profile, Commerce & More
Plugin Slug:: wp-recall
Installations: 2,000+
Vulnerability:: SQL Injection
Patched in Version:: 16.26.12
Severity Score:: High
CVE:: 2024-9770

Plugin:: Currency Switcher for WooCommerce
Plugin Slug:: currency-switcher-for-woocommerce
Installations: 1,000+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: 0.0.8
Severity Score:: High
CVE:: 2025-30857

Plugin:: Custom Field For WP Job Manager
Plugin Slug:: custom-field-for-wp-job-manager
Installations: 1,000+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: 1.5
Severity Score:: Medium
CVE:: 2025-30856

Plugin:: Dr. Flex
Plugin Slug:: dr-flex
Installations: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.0.1
Severity Score:: Medium
CVE:: 2025-30850

Plugin:: Dropdown multisite selector
Plugin Slug:: dropdown-multisite-selector
Installations: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 0.9.4
Severity Score:: Medium
CVE:: 2025-31090

Plugin:: Taxi Booking Manager for WooCommerce – WordPress plugin | Ecab
Plugin Slug:: ecab-taxi-booking-manager
Installations: 1,000+
Vulnerability:: Broken Access Control
Patched in Version:: 1.2.2
Severity Score:: Medium
CVE:: 2025-30839

Plugin:: Event post
Plugin Slug:: event-post
Installations: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 5.9.10
Severity Score:: Medium
CVE:: 2025-2167

Plugin:: Event Tickets with Ticket Scanner
Plugin Slug:: event-tickets-with-ticket-scanner
Installations: 1,000+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: 2.5.4
Severity Score:: Medium
CVE:: 2025-1762

Plugin:: Flexible Cookies
Plugin Slug:: flexible-cookies
Installations: 1,000+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: 1.1.9
Severity Score:: Medium
CVE:: 2025-30805

Plugin:: WP Fast Total Search – The Power of Indexed Search
Plugin Slug:: fulltext-search
Installations: 1,000+
Vulnerability:: Broken Access Control
Patched in Version:: 1.79.264
Severity Score:: Medium
CVE:: 2025-30894

Plugin:: Greek Multi Tool – Ultimate Greek Language Toolkit for WordPress
Plugin Slug:: greek-multi-tool
Installations: 1,000+
Vulnerability:: Broken Access Control
Patched in Version:: 2.3.2
Severity Score:: High
CVE:: 2025-30797

Plugin:: Just Writing Statistics
Plugin Slug:: just-writing-statistics
Installations: 1,000+
Vulnerability:: Broken Access Control
Patched in Version:: 5.4
Severity Score:: Medium
CVE:: 2025-30803

Plugin:: Novelist
Plugin Slug:: novelist
Installations: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.2.4
Severity Score:: Medium
CVE:: 2025-30847

Plugin:: Off-Canvas Sidebars & Menus (Slidebars)
Plugin Slug:: off-canvas-sidebars
Installations: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 0.5.8.4
Severity Score:: Medium
CVE:: 2025-30860

Plugin:: Quotes llama
Plugin Slug:: quotes-llama
Installations: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.1.1
Severity Score:: Medium
CVE:: 2025-30786

Plugin:: SearchIQ – The Search Solution
Plugin Slug:: searchiq
Installations: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 4.8
Severity Score:: Medium
CVE:: 2025-30867

Plugin:: SKT Addons for Elementor
Plugin Slug:: skt-addons-for-elementor
Installations: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.6
Severity Score:: Medium
CVE:: 2025-30812

Plugin:: SKU Generator for WooCommerce
Plugin Slug:: sku-for-woocommerce
Installations: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.6.3
Severity Score:: High
CVE:: 2025-30917

Plugin:: Sunshine Photo Cart: Free Client Photo Galleries for Photographers
Plugin Slug:: sunshine-photo-cart
Installations: 1,000+
Vulnerability:: PHP Object Injection
Patched in Version:: 3.4.11
Severity Score:: Critical
CVE:: 2025-31084

Plugin:: WordPress Tour & Travel Booking Plugin for WooCommerce – WpTravelly
Plugin Slug:: tour-booking-manager
Installations: 1,000+
Vulnerability:: Local File Inclusion
Patched in Version:: 1.8.8
Severity Score:: High
CVE:: 2025-30891

Plugin:: WishSuite – Wishlist for WooCommerce
Plugin Slug:: wishsuite
Installations: 1,000+
Vulnerability:: Local File Inclusion
Patched in Version:: 1.4.5
Severity Score:: High
CVE:: 2025-30820

Plugin:: WP Docs
Plugin Slug:: wp-docs
Installations: 1,000+
Vulnerability:: Broken Access Control
Patched in Version:: 2.2.7
Severity Score:: Medium
CVE:: 2025-31417

Plugin:: Team Manager – Team Member Showcase with grid, slider, table Elementor widget & shortcode
Plugin Slug:: wp-team-manager
Installations: 1,000+
Vulnerability:: Local File Inclusion
Patched in Version:: 2.2.0
Severity Score:: High
CVE:: 2025-30868

Plugin:: The Ultimate WordPress Toolkit – WP Extended
Plugin Slug:: wpextended
Installations: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.0.15
Severity Score:: High
CVE:: 2025-30796

Plugin:: YayExtra – WooCommerce Extra Product Options
Plugin Slug:: yayextra
Installations: 1,000+
Vulnerability:: Broken Access Control
Patched in Version:: 1.5.3
Severity Score:: High
CVE:: 2025-31415

Plugin:: 3DPrint Lite
Plugin Slug:: 3dprint-lite
Installations: 900+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: 2.1.3.6
Severity Score:: Medium
CVE:: 2025-30865

Plugin:: Exchange Rates
Plugin Slug:: exchange-rates
Installations: 900+
Vulnerability:: Broken Access Control
Patched in Version:: 1.2.3
Severity Score:: Medium
CVE:: 2025-30864

Plugin:: Football Pool
Plugin Slug:: football-pool
Installations: 900+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: 2.12.3
Severity Score:: Medium
CVE:: 2025-30764

Plugin:: Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms
Plugin Slug:: integration-for-contact-form-7-and-google-sheets
Installations: 900+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: 1.1.0
Severity Score:: Medium
CVE:: 2025-30863

Plugin:: RPS Include Content
Plugin Slug:: rps-include-content
Installations: 900+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.2.2
Severity Score:: Medium
CVE:: 2025-31093

Plugin:: Serial Codes Generator and Validator with WooCommerce Support
Plugin Slug:: serial-codes-generator-and-validator
Installations: 900+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: 2.7.8
Severity Score:: Medium
CVE:: 2025-30854

Plugin:: Usermaven
Plugin Slug:: usermaven
Installations: 900+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: 1.2.2
Severity Score:: Medium
CVE:: 2025-31079

Plugin:: One to one user Chat by WPGuppy
Plugin Slug:: wpguppy-lite
Installations: 900+
Vulnerability:: SQL Injection
Patched in Version:: 1.1.4
Severity Score:: High
CVE:: 2025-30775

Plugin:: Leaky Paywall
Plugin Slug:: leaky-paywall
Installations: 800+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 4.21.8
Severity Score:: Medium
CVE:: 2025-31083

Plugin:: Login Widget for Ultimate Member
Plugin Slug:: login-widget-for-ultimate-member
Installations: 800+
Vulnerability:: Local File Inclusion
Patched in Version:: 1.1.3
Severity Score:: High
CVE:: 2025-30890

Plugin:: Cloudflare Turnstile or reCAPTCHA For any Pages, to Block Spam and Hackers Attack.
Plugin Slug:: recaptcha-for-all
Installations: 800+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: 2.23
Severity Score:: Medium
CVE:: 2025-30862

Plugin:: Terms & Conditions Per Product
Plugin Slug:: terms-and-conditions-per-product
Installations: 800+
Vulnerability:: Broken Access Control
Patched in Version:: 1.2.16
Severity Score:: Medium
CVE:: 2025-30866

Plugin:: TWB Woocommerce Reviews
Plugin Slug:: twb-woocommerce-reviews
Installations: 800+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: 1.7.8
Severity Score:: Medium
CVE:: 2025-30801

Plugin:: ValidateCertify Free
Plugin Slug:: validar-certificados-de-cursos
Installations: 800+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: 1.6.2
Severity Score:: Medium
CVE:: 2025-30811

Plugin:: WooCommerce Fattureincloud
Plugin Slug:: woo-fattureincloud
Installations: 800+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.6.8
Severity Score:: High
CVE:: 2025-30837

Plugin:: WP Cassify
Plugin Slug:: wp-cassify
Installations: 800+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.3.6
Severity Score:: Medium
CVE:: 2025-30771

Plugin:: WP Compress for MainWP
Plugin Slug:: wp-compress-mainwp
Installations: 800+
Vulnerability:: Server Side Request Forgery (SSRF)
Patched in Version:: 6.30.06
Severity Score:: Medium
CVE:: 2025-31076

Plugin:: Better Section Navigation
Plugin Slug:: better-section-navigation
Installations: 700+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.7.0
Severity Score:: Medium
CVE:: 2025-31465

Plugin:: Custom Fields Account Registration For Woocommerce
Plugin Slug:: custom-fields-account-registration-for-woocommerce
Installations: 700+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: 1.2
Severity Score:: Medium
CVE:: 2025-30888

Plugin:: Houzez Property Feed
Plugin Slug:: houzez-property-feed
Installations: 700+
Vulnerability:: Arbitrary File Download
Patched in Version:: 2.5.5
Severity Score:: High
CVE:: 2025-30793

Plugin:: Custom Login Logo
Plugin Slug:: ideal-wp-login-logo-changer
Installations: 700+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: 1.1.8
Severity Score:: Medium
CVE:: 2025-30822

Plugin:: Our Team Members – Team Members WordPress Plugin
Plugin Slug:: our-team-members
Installations: 700+
Vulnerability:: Sensitive Data Exposure
Patched in Version:: 2.3
Severity Score:: Medium
CVE:: 2025-30802

Plugin:: PDF for WPForms + Drag and Drop Template Builder
Plugin Slug:: pdf-for-wpforms
Installations: 700+
Vulnerability:: Broken Access Control
Patched in Version:: 5.3.1
Severity Score:: Medium
CVE:: 2025-30767

Plugin:: wordpress publish post email notification
Plugin Slug:: publish-post-email-notification
Installations: 700+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: 1.0.2.4
Severity Score:: Medium
CVE:: 2025-30816

Plugin:: Stock Sync for WooCommerce with Google Sheets | WooCommerce Bulk Edit, Stock Management, Inventory Management System & more – FlexStock
Plugin Slug:: stock-sync-with-google-sheet-for-woocommerce
Installations: 700+
Vulnerability:: SQL Injection
Patched in Version:: 3.13.2
Severity Score:: High
CVE:: 2025-30765

Plugin:: Product Author for WooCommerce
Plugin Slug:: wc-product-author
Installations: 700+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: 1.0.8
Severity Score:: Medium
CVE:: 2025-30872

Plugin:: wpShopGermany IT-RECHT KANZLEI
Plugin Slug:: wpshopgermany-it-recht-kanzlei
Installations: 700+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: 2.1
Severity Score:: Medium
CVE:: 2025-30804

Plugin:: Anthologize
Plugin Slug:: anthologize
Installations: 600+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: 0.8.3
Severity Score:: Medium
CVE:: 2025-30823

Plugin:: Digital License Manager
Plugin Slug:: digital-license-manager
Installations: 600+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.7.4
Severity Score:: High
CVE:: 2025-2635

Plugin:: FormLift for Infusionsoft Web Forms
Plugin Slug:: formlift
Installations: 600+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 7.5.20
Severity Score:: Medium
CVE:: 2025-31434

Plugin:: Simple Giveaways – Grow your business, email lists and traffic with contests
Plugin Slug:: giveasap
Installations: 600+
Vulnerability:: SQL Injection
Patched in Version:: 2.48.2
Severity Score:: High
CVE:: 2025-30819

Plugin:: SNORDIAN’s H5PxAPIkatchu
Plugin Slug:: h5pxapikatchu
Installations: 600+
Vulnerability:: Broken Access Control
Patched in Version:: 0.4.15
Severity Score:: Medium
CVE:: 2025-30821

Plugin:: Cool Author Box – For Widget and Post Content
Plugin Slug:: hm-cool-author-box-widget
Installations: 600+
Vulnerability:: Broken Access Control
Patched in Version:: 3.0.0
Severity Score:: Medium
CVE:: 2025-30830

Plugin:: IP Locator
Plugin Slug:: ip-locator
Installations: 600+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 4.2.0
Severity Score:: Medium
CVE:: 2025-30826

Plugin:: jAlbum Bridge
Plugin Slug:: jalbum-bridge
Installations: 600+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.0.18
Severity Score:: Medium
CVE:: 2025-30818

Plugin:: jAlbum Bridge
Plugin Slug:: jalbum-bridge
Installations: 600+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.0.19
Severity Score:: Medium
CVE:: 2025-30768

Plugin:: Listamester
Plugin Slug:: listamester
Installations: 600+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.3.6
Severity Score:: Medium
CVE:: 2025-30813

Plugin:: Contact Form, Drag and Drop Form Builder Plugin – Live Forms
Plugin Slug:: liveforms
Installations: 600+
Vulnerability:: Settings Change
Patched in Version:: 4.8.5
Severity Score:: Medium
CVE:: 2025-30809

Plugin:: Simplebooklet PDF Viewer and Embedder
Plugin Slug:: simplebooklet
Installations: 600+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.1.3
Severity Score:: Medium
CVE:: 2025-30922

Plugin:: Verge3D Publishing and E-Commerce
Plugin Slug:: verge3d
Installations: 600+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: 4.8.3
Severity Score:: Medium
CVE:: 2025-30833

Plugin:: Textmetrics
Plugin Slug:: webtexttool
Installations: 600+
Vulnerability:: Broken Access Control
Patched in Version:: 3.6.2
Severity Score:: Medium
CVE:: 2025-30824

Plugin:: Lead Form Data Collection to CRM
Plugin Slug:: wp-leads-builder-any-crm
Installations: 600+
Vulnerability:: SQL Injection
Patched in Version:: 3.1
Severity Score:: High
CVE:: 2025-30810

Plugin:: Zoho Billing – Embed Payment Form
Plugin Slug:: zoho-subscriptions
Installations: 600+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 4.1
Severity Score:: Medium
CVE:: 2025-30900

Plugin:: Accounting for WooCommerce
Plugin Slug:: accounting-for-woocommerce
Installations: 500+
Vulnerability:: Local File Inclusion
Patched in Version:: 1.6.9
Severity Score:: High
CVE:: 2025-30835

Plugin:: Christmas Panda
Plugin Slug:: christmas-panda
Installations: 500+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: 1.1.0
Severity Score:: Medium
CVE:: 2025-30842

Plugin:: Clearout Email Validator – Real-Time Email Verification on WordPress Forms
Plugin Slug:: clearout-email-validator
Installations: 500+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.2.1
Severity Score:: Medium
CVE:: 2025-30789

Plugin:: Comment Approved Notifier Extended
Plugin Slug:: comment-approved-notifier-extended
Installations: 500+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 5.3
Severity Score:: Medium
CVE:: 2025-30792

Plugin:: EZ SQL Reports Shortcode Widget and DB Backup
Plugin Slug:: elisqlreports
Installations: 500+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: 5.25.10
Severity Score:: High
CVE:: 2025-30788

Plugin:: EZ SQL Reports Shortcode Widget and DB Backup
Plugin Slug:: elisqlreports
Installations: 500+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: 5.25.10
Severity Score:: High
CVE:: 2025-30787

Plugin:: Gallery for Social Photo
Plugin Slug:: feed-instagram-lite
Installations: 500+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.0.0.37
Severity Score:: Medium
CVE:: 2025-26742

Plugin:: Hesabfa Accounting
Plugin Slug:: hesabfa-accounting
Installations: 500+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: 2.2.0
Severity Score:: Medium
CVE:: 2025-30815

Plugin:: Slider by BestWebSoft
Plugin Slug:: slider-bws
Installations: 500+
Vulnerability:: SQL Injection
Patched in Version:: 1.1.1
Severity Score:: High
CVE:: 2025-31099

Plugin:: Subscribe to Download Lite – Download after Email Subscription Form WordPress Plugin
Plugin Slug:: subscribe-to-download-lite
Installations: 500+
Vulnerability:: Local File Inclusion
Patched in Version:: 1.3.0
Severity Score:: High
CVE:: 2025-30782

Plugin:: Subscribe to Download Lite – Download after Email Subscription Form WordPress Plugin
Plugin Slug:: subscribe-to-download-lite
Installations: 500+
Vulnerability:: Local File Inclusion
Patched in Version:: 1.3.0
Severity Score:: High
CVE:: 2025-30785

Plugin:: Chatbox Manager
Plugin Slug:: wa-chatbox-manager
Installations: 500+
Vulnerability:: Broken Access Control
Patched in Version:: 1.2.3
Severity Score:: Medium
CVE:: 2025-30790

Plugin:: Web Directory Free
Plugin Slug:: web-directory-free
Installations: 500+
Vulnerability:: SQL Injection
Patched in Version:: 1.7.7
Severity Score:: Critical
CVE:: 2025-28904

Plugin:: WordPress WP-Advanced-Search
Plugin Slug:: wp-advanced-search
Installations: 500+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.3.9.3
Severity Score:: Medium
CVE:: 2024-10554

Plugin:: WP Google Street View (with 360° virtual tour) & Google maps + Local SEO
Plugin Slug:: wp-google-street-view
Installations: 500+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.1.6
Severity Score:: Medium
CVE:: 2025-30799

Plugin:: WP Subscription Forms – Subscription Form Plugin for WordPress
Plugin Slug:: wp-subscription-forms
Installations: 500+
Vulnerability:: SQL Injection
Patched in Version:: 1.2.4
Severity Score:: High
CVE:: 2025-30784

Plugin:: Z Companion
Plugin Slug:: z-companion
Installations: 500+
Vulnerability:: Broken Access Control
Patched in Version:: 1.1.0
Severity Score:: Medium
CVE:: 2025-30817

Plugin:: Administrator Z
Plugin Slug:: administrator-z
Installations: 400+
Vulnerability:: Broken Access Control
Patched in Version:: 2025.03.27
Severity Score:: High
CVE:: 2025-2815

Plugin:: Store Locator Widget
Plugin Slug:: store-locator-widget
Installations: 400+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: 2025r3
Severity Score:: High
CVE:: 2025-30919

Plugin:: Support Genix – Helpdesk & Customer Support Ticket System
Plugin Slug:: support-genix-lite
Installations: 400+
Vulnerability:: Insecure Direct Object References (IDOR)
Patched in Version:: 1.4.12
Severity Score:: Medium
CVE:: 2025-30777

Plugin:: WIP WooCarousel Lite
Plugin Slug:: wip-woocarousel-lite
Installations: 400+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: 1.1.8
Severity Score:: High
CVE:: 2025-30769

Plugin:: About Author
Plugin Slug:: about-author
Installations: 300+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.6.3
Severity Score:: High
CVE:: 2025-30808

Plugin:: Better WishList API
Plugin Slug:: better-wlm-api
Installations: 300+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.1.5
Severity Score:: High
CVE:: 2025-30798

Plugin:: Gift Message for WooCommerce
Plugin Slug:: gift-message-for-woocommerce
Installations: 300+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: 1.7.9
Severity Score:: Medium
CVE:: 2025-30923

Plugin:: Stylish Google Sheet Reader 4.0 – Seamlessly Embed Google Sheets as Responsive Data Tables
Plugin Slug:: stylish-google-sheet-reader
Installations: 300+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 4.1
Severity Score:: High
CVE:: 2024-13863

Plugin:: CM Download Manager – Simplify file sharing with powerful download management
Plugin Slug:: cm-download-manager
Installations: 200+
Vulnerability:: Arbitrary File Deletion
Patched in Version:: 3.0.0
Severity Score:: High
CVE:: 2025-30910

Plugin:: Multiple Shipping And Billing Address For Woocommerce
Plugin Slug:: different-shipping-and-billing-address-for-woocommerce
Installations: 200+
Vulnerability:: PHP Object Injection
Patched in Version:: 1.6
Severity Score:: Critical
CVE:: 2025-31087

Plugin:: Image Wall
Plugin Slug:: image-wall
Installations: 200+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.1
Severity Score:: High
CVE:: 2025-30869

Plugin:: Next-Cart Store to WooCommerce Migration
Plugin Slug:: nextcart-woocommerce-migration
Installations: 200+
Vulnerability:: SQL Injection
Patched in Version:: 3.9.5
Severity Score:: Critical
CVE:: 2025-30807

Plugin:: Cart tracking for WooCommerce
Plugin Slug:: cart-tracking-for-woocommerce
Installations: 100+
Vulnerability:: SQL Injection
Patched in Version:: 1.0.17
Severity Score:: High
CVE:: 2025-30791

Plugin:: CRM and Lead Management by vcita
Plugin Slug:: crm-customer-relationship-management-by-vcita
Installations: 100+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.7.5
Severity Score:: Medium
CVE:: 2024-13702

Plugin:: DICOM Support
Plugin Slug:: dicom-support
Installations: 100+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 0.10.7
Severity Score:: Medium
CVE:: 2024-12623

Plugin:: Primer MyData for Woocommerce
Plugin Slug:: primer-mydata
Installations: 100+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 4.2.4
Severity Score:: High
CVE:: 2025-30924

Plugin:: WP2LEADS | WordPress und KlickTipp einfach verbinden – WooCommerce und KlickTipp einfach verbinden
Plugin Slug:: wp2leads
Installations: 100+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.4.7
Severity Score:: High
CVE:: 2025-30827

Plugin:: xili-dictionary
Plugin Slug:: xili-dictionary
Installations: 100+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.12.5.1
Severity Score:: High
CVE:: 2025-30840

Plugin:: MDJM Event Management
Plugin Slug:: mobile-dj-manager
Installations: 90+
Vulnerability:: PHP Object Injection
Patched in Version:: 1.7.5.3
Severity Score:: High
CVE:: 2025-31074

Plugin:: WPC Smart Upsell Funnel for WooCommerce
Plugin Slug:: wpc-smart-upsell-funnel
Installations: 90+
Vulnerability:: Privilege Escalation
Patched in Version:: 3.0.5
Severity Score:: High
CVE:: 2025-30772

Plugin:: Material Dashboard
Plugin Slug:: material-dashboard
Installations: 80+
Vulnerability:: Privilege Escalation
Patched in Version:: 1.4.6
Severity Score:: Critical
CVE:: 2025-31095

Plugin:: Hostel
Plugin Slug:: hostel
Installations: 50+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.1.5.6
Severity Score:: High
CVE:: 2025-31102

Plugin:: Hostel
Plugin Slug:: hostel
Installations: 50+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.1.5.5
Severity Score:: High
CVE:: 2025-30848

Plugin:: AEC Kiosque
Plugin Slug:: aec-kiosque
Installations: 40+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.9.4
Severity Score:: High
CVE:: 2025-30902

Plugin:: BizCalendar Web
Plugin Slug:: bizcalendar-web
Installations: 30+
Vulnerability:: SQL Injection
Patched in Version:: 1.1.0.35
Severity Score:: High
CVE:: 2025-30843

Plugin:: EO4WP: EmailOctopus for WordPress
Plugin Slug:: fw-integration-for-emailoctopus
Installations: 30+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.0.8.5
Severity Score:: Medium
CVE:: 2025-30763

Plugin:: MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet
Plugin Slug:: paid-membership
Installations: 30+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.9.30
Severity Score:: Medium
CVE:: 2025-31075

Plugin:: Your Simple SVG Support
Plugin Slug:: your-simple-svg-support
Installations: 10+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.0.2
Severity Score:: Medium
CVE:: 2025-2542

Plugin:: Bitspecter Suite
Plugin Slug:: bitspecter-suite
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.1.0
Severity Score:: Medium
CVE:: 2025-2577

Plugin:: Booknetic
Plugin Slug:: booknetic
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: 4.1.5
Severity Score:: Medium
CVE:: 2024-13146

Plugin:: Bridge Core
Plugin Slug:: bridge-core
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.3.1
Severity Score:: Medium
CVE:: 2025-31409

Plugin:: BWL Advanced FAQ Manager
Plugin Slug:: bwl-advanced-faq-manager
Vulnerability:: Broken Access Control
Patched in Version:: 2.1.5
Severity Score:: Medium
CVE:: 2024-13801

Plugin:: Fusion Builder
Plugin Slug:: fusion-builder
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.11.15
Severity Score:: Medium
CVE:: 2025-1665

Plugin:: JetBlocks For Elementor
Plugin Slug:: jet-blocks
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.3.16.1
Severity Score:: Medium
CVE:: 2025-30987

Plugin:: JetSearch
Plugin Slug:: jet-search
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.5.7.1
Severity Score:: Medium
CVE:: 2025-31043

Plugin:: JetSmartFilters
Plugin Slug:: jet-smart-filters
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.6.4
Severity Score:: Medium
CVE:: 2025-30963

Plugin:: JetWooBuilder
Plugin Slug:: jet-woo-builder
Vulnerability:: Local File Inclusion
Patched in Version:: 2.1.18.1
Severity Score:: High
CVE:: 2025-31016

Plugin:: JetProductGallery
Plugin Slug:: jet-woo-product-gallery
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.1.22.1
Severity Score:: Medium
CVE:: 2025-31412

Plugin:: Smart Maintenance Mode
Plugin Slug:: smart-maintenance-mode
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.5.2
Severity Score:: Medium
CVE:: 2024-12682

Plugin:: tagDiv Composer
Plugin Slug:: td-composer
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: 5.4
Severity Score:: High
CVE:: 2025-1705

Plugin:: tagDiv Composer
Plugin Slug:: td-composer
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 5.4
Severity Score:: High
CVE:: 2025-2804

Plugin:: Shortcodes by United Themes
Plugin Slug:: ut-shortcodes
Vulnerability:: Content Injection
Patched in Version:: 5.1.7
Severity Score:: Medium
CVE:: 2024-13557

WordPress Themes — 4 Patched / 18 Unpatched

Theme:: AuraMart
Theme Slug:: auramart
Downloads: 804
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-26922

Theme:: Hester
Theme Slug:: hester
Downloads: 7,289
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-26734

Theme:: MorningTime Lite
Theme Slug:: morningtime-lite
Downloads: 40,088
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-26736

Theme:: StoreBiz
Theme Slug:: storebiz
Downloads: 102,376
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-26732

Theme:: Build
Theme Slug:: build
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-26869

Theme:: Churel
Theme Slug:: churel
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-31419

Theme:: City Store
Theme Slug:: city-store
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-26737

Theme:: Navigation Tree Elementor
Theme Slug:: navigation-tree-elementor
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-30562

Theme:: newseqo
Theme Slug:: newseqo
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-26739

Theme:: RainbowNews
Theme Slug:: rainbownews
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-26747

Theme:: Rapyd Payment Extension for WooCommerce
Theme Slug:: rapyd-payments
Vulnerability:: PHP Object Injection
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2025-30618

Theme:: Shopo
Theme Slug:: shopo
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-31013

Theme:: Themify Sidepane WordPress Theme
Theme Slug:: sidepane
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-31013

Theme:: Traveler
Theme Slug:: traveler
Vulnerability:: Broken Access Control
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-26956

Theme:: Traveler
Theme Slug:: traveler
Vulnerability:: Broken Access Control
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-26733

Theme:: Traveler
Theme Slug:: traveler
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2025-26898

Theme:: Traveler
Theme Slug:: traveler
Vulnerability:: PHP Object Injection
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2025-26873

Theme:: Whitish Lite
Theme Slug:: whitish-lite
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-22278

Theme:: Big Store
Theme Slug:: big-store
Downloads: 135,572
Vulnerability:: Broken Access Control
Patched in Version:: 2.0.9
Severity Score:: Medium
CVE:: 2025-30881

Theme:: Unlimited
Theme Slug:: unlimited
Downloads: 66,367
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.46
Severity Score:: Medium
CVE:: 2025-31073

Theme:: Real Estate 7
Theme Slug:: realestate-7
Vulnerability:: Arbitrary File Upload
Patched in Version:: 3.5.5
Severity Score:: High
CVE:: 2025-2891

Theme:: WP Weixin
Theme Slug:: wp-weixin
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.3.17
Severity Score:: Medium
CVE:: 2025-30875

Solid Security is part of Solid Suite — The best foundation for WordPress websites.

Every WordPress site needs security, backups, and management tools. That’s Solid Suite — an integrated bundle of three plugins: Solid Security, Solid Backups, and Solid Central. You also get access to Solid Academy’s learning resources for WordPress professionals. Build your next WordPress website on a solid foundation with Solid Suite!

Get Solid Security

Author:

Sarah Ulmer

Sarah has been with SolidWP since 2015. Thanks to her deep connection to the brand, its products, and its users, Sarah was tapped as Solid’s primary Product Marketer in 2023. Sarah helps ensure that Solid’s product development team understands our users’ needs. When not at work, Sarah can be found at home with her husband, their three boys, and their dogs. Sarah enjoys long family walks, running with her lab, and watching her three boys play soccer. Sarah is originally from Texas and loves watching football games (Go Longhorns!)

Browse all of Sarah's articles

Sign up

Placeholder text

Thanks

Oops something went wrong, please try submitting again

Solid Suite

Protect

Repair

Manage

Free Plugins

Solid Suite

Academy

Solid Academy

Guides

Livestreams

Tutorials Academy

Resources

Blog

Vulnerability Report

Support

Documentation

Table of Contents

WordPress Core

WordPress Plugins — 263 Patched / 257 Unpatched