WordPress Vulnerability Report

WordPress Vulnerability Report — April 23, 2025

Since last week, 304 new vulnerabilities emerged in the WordPress ecosystem, including 279 plugins and 25 themes. 142 of the vulnerable plugins remain unpatched, but Solid Security Pro users are protected by virtual patching from Patchstack.

Avatar photo
Sarah Ulmer

Published:Apr 23, 2025

Filed Under:WordPress Vulnerability Report

Reading Time:54 min.

In this report, 304 vulnerabilities have been publicly disclosed. Security patches for 162 of these plugins and themes are available now, so run those updates as soon as possible. If you’re a Solid Security Pro user, the version management tool may have already warned you and updated these plugins, depending on your settings.

Additionally, there are 142 plugin and theme vulnerabilities, and no patch has been available yet. If you’re a Solid Security Pro user, those vulnerabilities are already protected by the Solid Security firewall. Virtual patches from Patchstack will be applied when a vulnerability is considered high or medium risk. If no patch is forthcoming from the vendor or the vulnerable software has been marked “closed” and dropped from the official WordPress repositories, you should deactivate it soon and look for alternative solutions.

Along with poor user account security, vulnerable plugins and themes are among the top reasons why WordPress websites get hacked. Unfortunately, cyberattacks are increasing in volume and sophistication. They’re also increasingly aimed at small to mid-sized businesses.

Our WordPress Vulnerability Report covers the latest emerging WordPress plugin, theme, and core vulnerabilities. Each vulnerability will have a severity rating of Low, Medium, High, or Critical. Responsible disclosure of vulnerabilities is essential to keeping the WordPress community safe. Please share this report to help spread the word and make WordPress — and the web — more secure.

WordPress Core

WordPress 6.8 “Cecil” is here! Launched April 15, 2025, it honors jazz legend Cecil Taylor, whose pioneering piano fused chaos and harmony. Explore its bold features with the same experimental spirit.

Plus, WordCamp Europe 2025 lands in Basel, Switzerland, June 5-7! Connect with WordPress enthusiasts, developers, and pros for three days of learning, networking, and collaboration with the global community.

No new core vulnerabilities were disclosed this week.

WordPress Plugins — 153 Patched / 126 Unpatched

Master Slider – Responsive Touch Slider

Plugin:
Master Slider – Responsive Touch Slider
Plugin Slug:
master-slider
Installations
70,000+
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-39412
The vulnerability has not been patched. You should deactivate the plugin.

Simple Sitemap – Create a Responsive HTML Sitemap

Plugin:
Simple Sitemap – Create a Responsive HTML Sitemap
Plugin Slug:
simple-sitemap
Installations
70,000+
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-39413
The vulnerability has not been patched. You should deactivate the plugin.

Asgaros Forum

Plugin:
Asgaros Forum
Plugin Slug:
asgaros-forum
Installations
10,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-39514
The vulnerability has not been patched. You should deactivate the plugin.

Scriptless Social Sharing

Plugin:
Scriptless Social Sharing
Plugin Slug:
scriptless-social-sharing
Installations
10,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-39529
The vulnerability has not been patched. You should deactivate the plugin.

Logo Carousel Slider

Plugin:
Logo Carousel Slider
Plugin Slug:
logo-carousel-slider
Installations
8,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-39525
The vulnerability has not been patched. You should deactivate the plugin.

Checkout Files Upload for WooCommerce

Plugin:
Checkout Files Upload for WooCommerce
Plugin Slug:
checkout-files-upload-woocommerce
Installations
7,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-39520
The vulnerability has not been patched. You should deactivate the plugin.

License For Envato

Plugin:
License For Envato
Plugin Slug:
license-envato
Installations
5,000+
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-39399
The vulnerability has not been patched. You should deactivate the plugin.

Hotel Booking

Plugin:
Hotel Booking
Plugin Slug:
nd-booking
Installations
5,000+
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-39526
The vulnerability has not been patched. You should deactivate the plugin.

ACF: Google Font Selector

Plugin:
ACF: Google Font Selector
Plugin Slug:
acf-google-font-selector-field
Installations
3,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-39382
The vulnerability has not been patched. You should deactivate the plugin.

Anything Popup

Plugin:
Anything Popup
Plugin Slug:
anything-popup
Installations
3,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-39397
The vulnerability has not been patched. You should deactivate the plugin.

Directory Listings WordPress plugin – uListing

Plugin:
Directory Listings WordPress plugin – uListing
Plugin Slug:
ulisting
Installations
2,000+
Vulnerability:
Deserialization of untrusted data
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-32662
The vulnerability has not been patched. You should deactivate the plugin.

ActiveDEMAND

Plugin:
ActiveDEMAND
Plugin Slug:
activedemand
Installations
1,000+
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-39513
The vulnerability has not been patched. You should deactivate the plugin.

Basic Interactive World Map

Plugin:
Basic Interactive World Map
Plugin Slug:
basic-interactive-world-map
Installations
1,000+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-39517
The vulnerability has not been patched. You should deactivate the plugin.

Rescue Shortcodes

Plugin:
Rescue Shortcodes
Plugin Slug:
rescue-shortcodes
Installations
1,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-39528
The vulnerability has not been patched. You should deactivate the plugin.

Attendance Manager

Plugin:
Attendance Manager
Plugin Slug:
attendance-manager
Installations
900+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-39515
The vulnerability has not been patched. You should deactivate the plugin.

JS Job Manager

Plugin:
JS Job Manager
Plugin Slug:
js-jobs
Installations
800+
Vulnerability:
SQL Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2025-32626
The vulnerability has not been patched. You should deactivate the plugin.

JS Job Manager

Plugin:
JS Job Manager
Plugin Slug:
js-jobs
Installations
800+
Vulnerability:
Arbitrary File Upload
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2025-32660
The vulnerability has not been patched. You should deactivate the plugin.

Movylo Marketing Automation

Plugin:
Movylo Marketing Automation
Plugin Slug:
movylo-widget
Installations
800+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-32608
The vulnerability has not been patched. You should deactivate the plugin.

WP Flipclock

Plugin:
WP Flipclock
Plugin Slug:
wp-flipclock
Installations
800+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-39540
The vulnerability has not been patched. You should deactivate the plugin.

Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light

Plugin:
Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light
Plugin Slug:
excel-like-price-change-for-woocommerce-and-wp-e-commerce-light
Installations
700+
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-39378
The vulnerability has not been patched. You should deactivate the plugin.

MapSVG – Vector maps, Image maps, Google Maps

Plugin:
MapSVG – Vector maps, Image maps, Google Maps
Plugin Slug:
mapsvg-lite-interactive-vector-maps
Installations
700+
Vulnerability:
Arbitrary File Upload
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2025-32682
The vulnerability has not been patched. You should deactivate the plugin.

Question Answer

Plugin:
Question Answer
Plugin Slug:
question-answer
Installations
600+
Vulnerability:
PHP Object Injection
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-32647
The vulnerability has not been patched. You should deactivate the plugin.

Spice Blocks

Plugin:
Spice Blocks
Plugin Slug:
spice-blocks
Installations
600+
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-39532
The vulnerability has not been patched. You should deactivate the plugin.

WooMS

Plugin:
WooMS
Plugin Slug:
wooms
Installations
600+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-32602
The vulnerability has not been patched. You should deactivate the plugin.

Author WIP Progress Bar

Plugin:
Author WIP Progress Bar
Plugin Slug:
author-work-in-progress-bar
Installations
500+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-39516
The vulnerability has not been patched. You should deactivate the plugin.

Bulk Term Editor

Plugin:
Bulk Term Editor
Plugin Slug:
bulk-term-editor
Installations
500+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-39512
The vulnerability has not been patched. You should deactivate the plugin.

WordPress WP-Advanced-Search

Plugin:
WordPress WP-Advanced-Search
Plugin Slug:
wp-advanced-search
Installations
500+
Vulnerability:
Arbitrary File Upload
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-39538
The vulnerability has not been patched. You should deactivate the plugin.

Bulk Page Stub Creator

Plugin:
Bulk Page Stub Creator
Plugin Slug:
bulk-page-stub-creator
Installations
400+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-39519
The vulnerability has not been patched. You should deactivate the plugin.

Rating by BestWebSoft

Plugin:
Rating by BestWebSoft
Plugin Slug:
rating-bws
Installations
400+
Vulnerability:
PHP Object Injection
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-39527
The vulnerability has not been patched. You should deactivate the plugin.

Site Search 360

Plugin:
Site Search 360
Plugin Slug:
site-search-360
Installations
400+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-39530
The vulnerability has not been patched. You should deactivate the plugin.

Contact Form vCard Generator

Plugin:
Contact Form vCard Generator
Plugin Slug:
contact-form-vcard-generator
Installations
300+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-39521
The vulnerability has not been patched. You should deactivate the plugin.

Projectopia – WordPress Project Management

Plugin:
Projectopia – WordPress Project Management
Plugin Slug:
projectopia-core
Installations
300+
Vulnerability:
Privilege Escalation
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2025-32648
The vulnerability has not been patched. You should deactivate the plugin.

BruteGuard – Brute Force Login Protection

Plugin:
BruteGuard – Brute Force Login Protection
Plugin Slug:
bruteguard
Installations
200+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-39408
The vulnerability has not been patched. You should deactivate the plugin.

Dynamic Post

Plugin:
Dynamic Post
Plugin Slug:
dynamic-post
Installations
200+
Vulnerability:
Settings Change
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-39522
The vulnerability has not been patched. You should deactivate the plugin.

Starfish Review Generation & Marketing for WordPress

Plugin:
Starfish Review Generation & Marketing for WordPress
Plugin Slug:
starfish-reviews
Installations
200+
Vulnerability:
Privilege Escalation
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-39533
The vulnerability has not been patched. You should deactivate the plugin.

Capturly

Plugin:
Capturly
Plugin Slug:
capturly-optimize-your-website
Installations
100+
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-39379
The vulnerability has not been patched. You should deactivate the plugin.

Run Contests, Raffles, and Giveaways with ContestsWP

Plugin:
Run Contests, Raffles, and Giveaways with ContestsWP
Plugin Slug:
contest-code-checker
Installations
100+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-32634
The vulnerability has not been patched. You should deactivate the plugin.

Course Booking System

Plugin:
Course Booking System
Plugin Slug:
course-booking-system
Installations
100+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-32508
The vulnerability has not been patched. You should deactivate the plugin.

HelpGent – The Ultimate Form Builder & TypeForm Alternative on WordPress | Craft Conversational Multi Step Form with Video, Voice, Screen Recording, & Text Messaging

Plugin:
HelpGent – The Ultimate Form Builder & TypeForm Alternative on WordPress | Craft Conversational Multi Step Form with Video, Voice, Screen Recording, & Text Messaging
Plugin Slug:
helpgent
Installations
100+
Vulnerability:
PHP Object Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2025-32658
The vulnerability has not been patched. You should deactivate the plugin.

Local Magic

Plugin:
Local Magic
Plugin Slug:
local-magic
Installations
100+
Vulnerability:
SQL Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2025-32636
The vulnerability has not been patched. You should deactivate the plugin.

PDF 2 Post

Plugin:
PDF 2 Post
Plugin Slug:
pdf2post
Installations
100+
Vulnerability:
Remote Code Execution (RCE)
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2025-32583
The vulnerability has not been patched. You should deactivate the plugin.

Slazzer Background Changer

Plugin:
Slazzer Background Changer
Plugin Slug:
slazzer-background-changer
Installations
100+
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-39531
The vulnerability has not been patched. You should deactivate the plugin.

Theme Changer

Plugin:
Theme Changer
Plugin Slug:
theme-changer
Installations
100+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-39438
The vulnerability has not been patched. You should deactivate the plugin.

WooCommerce Products without featured images

Plugin:
WooCommerce Products without featured images
Plugin Slug:
woocommerce-products-without-featured-images
Installations
100+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-32545
The vulnerability has not been patched. You should deactivate the plugin.

Target Video Easy Publish

Plugin:
Target Video Easy Publish
Plugin Slug:
brid-video-easy-publish
Installations
80+
Vulnerability:
Arbitrary Code Execution
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-32688
The vulnerability has not been patched. You should deactivate the plugin.

Checkout Field Visibility for WooCommerce

Plugin:
Checkout Field Visibility for WooCommerce
Plugin Slug:
checkout-field-visibility-for-woocommerce
Installations
80+
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-39391
The vulnerability has not been patched. You should deactivate the plugin.

Product Lister for eBay

Plugin:
Product Lister for eBay
Plugin Slug:
product-lister-ebay
Installations
70+
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-39384
The vulnerability has not been patched. You should deactivate the plugin.

T&P Gallery Slider

Plugin:
T&P Gallery Slider
Plugin Slug:
tp-gallery-slider
Installations
70+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-32527
The vulnerability has not been patched. You should deactivate the plugin.

All push notification for WP

Plugin:
All push notification for WP
Plugin Slug:
all-push-notification
Installations
60+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-32546
The vulnerability has not been patched. You should deactivate the plugin.

WP_DEBUG Toggle

Plugin:
WP_DEBUG Toggle
Plugin Slug:
enable-wp-debug-toggle
Installations
60+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-32561
The vulnerability has not been patched. You should deactivate the plugin.

Appsero Helper

Plugin:
Appsero Helper
Plugin Slug:
appsero-helper
Installations
50+
Vulnerability:
SQL Injection
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-39377
The vulnerability has not been patched. You should deactivate the plugin.

Office Locator

Plugin:
Office Locator
Plugin Slug:
office-locator
Installations
50+
Vulnerability:
SQL Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2025-32665
The vulnerability has not been patched. You should deactivate the plugin.

WP Donate

Plugin:
WP Donate
Plugin Slug:
wp-donate
Installations
50+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-32637
The vulnerability has not been patched. You should deactivate the plugin.

ShopApper: Mobile App for WooCommerce

Plugin:
ShopApper: Mobile App for WooCommerce
Plugin Slug:
mobile-app-for-woocommerce
Installations
40+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-32638
The vulnerability has not been patched. You should deactivate the plugin.

BMA Lite – Appointment Booking and Scheduling Plugin

Plugin:
BMA Lite – Appointment Booking and Scheduling Plugin
Plugin Slug:
bma-lite-appointment-booking-and-scheduling
Installations
10+
Vulnerability:
SQL Injection
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-39518
The vulnerability has not been patched. You should deactivate the plugin.

Event Espresso – Custom Email Template Shortcode

Plugin:
Event Espresso – Custom Email Template Shortcode
Plugin Slug:
email-shortcode
Installations
10+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-32507
The vulnerability has not been patched. You should deactivate the plugin.

ZooEffect

Plugin:
ZooEffect
Plugin Slug:
1-jquery-photo-gallery-slideshow-flash
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-26954
The vulnerability has not been patched. You should deactivate the plugin.

Add to Header

Plugin:
Add to Header
Plugin Slug:
add-to-header
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-39423
The vulnerability has not been patched. You should deactivate the plugin.

Amazon Showcase WordPress Plugin

Plugin:
Amazon Showcase WordPress Plugin
Plugin Slug:
amazon-showcase-wordpress-widget
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-39431
The vulnerability has not been patched. You should deactivate the plugin.

AnalyticsWP

Plugin:
AnalyticsWP
Plugin Slug:
analyticswp
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-39388
The vulnerability has not been patched. You should deactivate the plugin.

AnalyticsWP

Plugin:
AnalyticsWP
Plugin Slug:
analyticswp
Vulnerability:
Sensitive Data Exposure
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-39394
The vulnerability has not been patched. You should deactivate the plugin.

Anthologize

Plugin:
Anthologize
Plugin Slug:
anthologize
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-39437
The vulnerability has not been patched. You should deactivate the plugin.

WPAMS

Plugin:
WPAMS
Plugin Slug:
apartment-management
Vulnerability:
Arbitrary File Upload
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2025-39402
The vulnerability has not been patched. You should deactivate the plugin.

WPAMS

Plugin:
WPAMS
Plugin Slug:
apartment-management
Vulnerability:
Privilege Escalation
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-39405
The vulnerability has not been patched. You should deactivate the plugin.

WPAMS

Plugin:
WPAMS
Plugin Slug:
apartment-management
Vulnerability:
Arbitrary File Upload
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2025-39401
The vulnerability has not been patched. You should deactivate the plugin.

WPAMS

Plugin:
WPAMS
Plugin Slug:
apartment-management
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2025-39406
The vulnerability has not been patched. You should deactivate the plugin.

WPAMS

Plugin:
WPAMS
Plugin Slug:
apartment-management
Vulnerability:
SQL Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2025-39395
The vulnerability has not been patched. You should deactivate the plugin.

WPAMS

Plugin:
WPAMS
Plugin Slug:
apartment-management
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-39392
The vulnerability has not been patched. You should deactivate the plugin.

WPAMS

Plugin:
WPAMS
Plugin Slug:
apartment-management
Vulnerability:
SQL Injection
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-39403
The vulnerability has not been patched. You should deactivate the plugin.

Avatar

Plugin:
Avatar
Plugin Slug:
avatar
Vulnerability:
Arbitrary File Deletion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-3520
The vulnerability has not been patched. You should deactivate the plugin.

Avatar

Plugin:
Avatar
Plugin Slug:
avatar
Vulnerability:
Insecure Direct Object References (IDOR)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-39434
The vulnerability has not been patched. You should deactivate the plugin.

bbPress2 shortcode whitelist

Plugin:
bbPress2 shortcode whitelist
Plugin Slug:
bbpress2-shortcode-whitelist
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-39432
The vulnerability has not been patched. You should deactivate the plugin.

Bknewsticker

Plugin:
Bknewsticker
Plugin Slug:
bknewsticker
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-39433
The vulnerability has not been patched. You should deactivate the plugin.

Broken Links Remover

Plugin:
Broken Links Remover
Plugin Slug:
broken-links-remover
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-39440
The vulnerability has not been patched. You should deactivate the plugin.

Login Manager

Plugin:
Login Manager
Plugin Slug:
customized-login
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-2613
The vulnerability has not been patched. You should deactivate the plugin.

Dashboard Notepads

Plugin:
Dashboard Notepads
Plugin Slug:
dashboard-notepads
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-39441
The vulnerability has not been patched. You should deactivate the plugin.

FAT Services Booking

Plugin:
FAT Services Booking
Plugin Slug:
fat-services-booking
Vulnerability:
SQL Injection
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-39355
The vulnerability has not been patched. You should deactivate the plugin.

Foodbakery Sticky Cart

Plugin:
Foodbakery Sticky Cart
Plugin Slug:
foodbakery-sticky-cart
Vulnerability:
PHP Object Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2025-39356
The vulnerability has not been patched. You should deactivate the plugin.

Grand Conference

Plugin:
Grand Conference
Plugin Slug:
grandconference
Vulnerability:
PHP Object Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2025-39354
The vulnerability has not been patched. You should deactivate the plugin.

Gravity Forms CSS Themes with Fontawesome and Placeholders

Plugin:
Gravity Forms CSS Themes with Fontawesome and Placeholders
Plugin Slug:
gravity-forms-css-themes-with-fontawesome-and-placeholder-support
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-39428
The vulnerability has not been patched. You should deactivate the plugin.

hockeydata LOS

Plugin:
hockeydata LOS
Plugin Slug:
hockeydata-los
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-26889
The vulnerability has not been patched. You should deactivate the plugin.

Hospital Management System

Plugin:
Hospital Management System
Plugin Slug:
hospital-management
Vulnerability:
SQL Injection
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-39357
The vulnerability has not been patched. You should deactivate the plugin.

I Draw

Plugin:
I Draw
Plugin Slug:
idraw
Vulnerability:
Arbitrary File Upload
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2025-39436
The vulnerability has not been patched. You should deactivate the plugin.

Simple Maps

Plugin:
Simple Maps
Plugin Slug:
interactive-maps
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-39424
The vulnerability has not been patched. You should deactivate the plugin.

KiotViet Sync

Plugin:
KiotViet Sync
Plugin Slug:
kiotvietsync
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-39381
The vulnerability has not been patched. You should deactivate the plugin.

KiotViet Sync

Plugin:
KiotViet Sync
Plugin Slug:
kiotvietsync
Vulnerability:
SQL Injection
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-32573
The vulnerability has not been patched. You should deactivate the plugin.

illow – Cookies Consent

Plugin:
illow – Cookies Consent
Plugin Slug:
lgpd-compliant-cookie-banner
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-39426
The vulnerability has not been patched. You should deactivate the plugin.

Macro Calculator with Admin Email Optin & Data

Plugin:
Macro Calculator with Admin Email Optin & Data
Plugin Slug:
macro-admin-email-data-optin-calculator
Vulnerability:
Sensitive Data Exposure
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-26730
The vulnerability has not been patched. You should deactivate the plugin.

Memberpress

Plugin:
Memberpress
Plugin Slug:
memberpress
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-39407
The vulnerability has not been patched. You should deactivate the plugin.

mLanguage

Plugin:
mLanguage
Plugin Slug:
mlanguage
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-39430
The vulnerability has not been patched. You should deactivate the plugin.

Modal Survey

Plugin:
Modal Survey
Plugin Slug:
modal-survey
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-39469
The vulnerability has not been patched. You should deactivate the plugin.

Modal Survey

Plugin:
Modal Survey
Plugin Slug:
modal-survey
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-39468
The vulnerability has not been patched. You should deactivate the plugin.

Modal Survey

Plugin:
Modal Survey
Plugin Slug:
modal-survey
Vulnerability:
SQL Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2025-39471
The vulnerability has not been patched. You should deactivate the plugin.

My auctions allegro

Plugin:
My auctions allegro
Plugin Slug:
my-auctions-allegro-free-edition
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-27009
The vulnerability has not been patched. You should deactivate the plugin.

My Marginalia

Plugin:
My Marginalia
Plugin Slug:
my-marginalia
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-39435
The vulnerability has not been patched. You should deactivate the plugin.

Redirect wordpress to welcome or landing page

Plugin:
Redirect wordpress to welcome or landing page
Plugin Slug:
redirect-to-welcome-or-landing-page
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-39417
The vulnerability has not been patched. You should deactivate the plugin.

Review Wave – Google Places Reviews

Plugin:
Review Wave – Google Places Reviews
Plugin Slug:
review-wave-google-places-reviews
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-39442
The vulnerability has not been patched. You should deactivate the plugin.

Revision Diet

Plugin:
Revision Diet
Plugin Slug:
revision-diet
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-39419
The vulnerability has not been patched. You should deactivate the plugin.

Revy

Plugin:
Revy
Plugin Slug:
revy
Vulnerability:
SQL Injection
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-32924
The vulnerability has not been patched. You should deactivate the plugin.

SUMO Reward Points

Plugin:
SUMO Reward Points
Plugin Slug:
rewardsystem
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-32925
The vulnerability has not been patched. You should deactivate the plugin.

RSS Manager

Plugin:
RSS Manager
Plugin Slug:
rss-manager
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-39418
The vulnerability has not been patched. You should deactivate the plugin.

Social Media Links

Plugin:
Social Media Links
Plugin Slug:
social-media-links
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-39415
The vulnerability has not been patched. You should deactivate the plugin.

spam-stopper

Plugin:
spam-stopper
Plugin Slug:
spam-stopper
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-39414
The vulnerability has not been patched. You should deactivate the plugin.

Style Manager

Plugin:
Style Manager
Plugin Slug:
style-manager
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-39425
The vulnerability has not been patched. You should deactivate the plugin.
Plugin:
Széchenyi 2020 Logo
Plugin Slug:
szechenyi-2020-logo
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-39429
The vulnerability has not been patched. You should deactivate the plugin.

Testimonial Slider And Showcase Pro

Plugin:
Testimonial Slider And Showcase Pro
Plugin Slug:
testimonial-slider-showcase-pro
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-32657
The vulnerability has not been patched. You should deactivate the plugin.

translit it!

Plugin:
translit it!
Plugin Slug:
translit-it
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-39416
The vulnerability has not been patched. You should deactivate the plugin.

TuriTop Booking System

Plugin:
TuriTop Booking System
Plugin Slug:
turitop-booking-system
Vulnerability:
PHP Object Injection
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-32571
The vulnerability has not been patched. You should deactivate the plugin.

Smart Sections Theme Builder – WPBakery Page Builder Addon

Plugin:
Smart Sections Theme Builder – WPBakery Page Builder Addon
Plugin Slug:
visucom-smart-sections
Vulnerability:
PHP Object Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2025-39410
The vulnerability has not been patched. You should deactivate the plugin.

WooCommerce Social Login

Plugin:
WooCommerce Social Login
Plugin Slug:
woo-social-login
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-39472
The vulnerability has not been patched. You should deactivate the plugin.

FoodBakery

Plugin:
FoodBakery
Plugin Slug:
wp-foodbakery
Vulnerability:
PHP Object Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2025-32927
The vulnerability has not been patched. You should deactivate the plugin.

WP Post to PDF Enhanced

Plugin:
WP Post to PDF Enhanced
Plugin Slug:
wp-post-to-pdf-enhanced
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-39427
The vulnerability has not been patched. You should deactivate the plugin.

WP Social Bookmarking

Plugin:
WP Social Bookmarking
Plugin Slug:
wp-social-bookmarking
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-39422
The vulnerability has not been patched. You should deactivate the plugin.

WP Sticky Side Buttons

Plugin:
WP Sticky Side Buttons
Plugin Slug:
wp-sticky-side-buttons
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-39421
The vulnerability has not been patched. You should deactivate the plugin.

WP Syntax

Plugin:
WP Syntax
Plugin Slug:
wp-syntax
Vulnerability:
Denial of Service Attack
Patched in Version:
No Fix
Severity Score:
Low
CVE:
2024-13926
The vulnerability has not been patched. You should deactivate the plugin.

WP Twitter Button

Plugin:
WP Twitter Button
Plugin Slug:
wp-twitter-button
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-39420
The vulnerability has not been patched. You should deactivate the plugin.

WordPress Video Robot – The Ultimate Video Importer

Plugin:
WordPress Video Robot – The Ultimate Video Importer
Plugin Slug:
wp-video-robot
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-39409
The vulnerability has not been patched. You should deactivate the plugin.

wpLike2Get

Plugin:
wpLike2Get
Plugin Slug:
wplike2get
Vulnerability:
Sensitive Data Exposure
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-39439
The vulnerability has not been patched. You should deactivate the plugin.

WhatsApp Click to Chat Plugin for WordPress

Plugin:
WhatsApp Click to Chat Plugin for WordPress
Plugin Slug:
wpt-whatsapp
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-39411
The vulnerability has not been patched. You should deactivate the plugin.

Xelion Webchat

Plugin:
Xelion Webchat
Plugin Slug:
xelion-webchat
Vulnerability:
Privilege Escalation
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-39542
The vulnerability has not been patched. You should deactivate the plugin.

Contact Form 7

Plugin:
Contact Form 7
Plugin Slug:
contact-form-7
Installations
10,000,000+
Vulnerability:
Other Vulnerability Type
Patched in Version:
6.0.6
Severity Score:
Medium
CVE:
2025-3247
The vulnerability has been patched, so you should update to version 6.0.6.

Essential Addons for Elementor – Popular Elementor Addon With Ready Templates, Advanced Widgets, Kits & WooCommerce Builders

Plugin:
Essential Addons for Elementor – Popular Elementor Addon With Ready Templates, Advanced Widgets, Kits & WooCommerce Builders
Plugin Slug:
essential-addons-for-elementor-lite
Installations
2,000,000+
Vulnerability:
Sensitive Data Exposure
Patched in Version:
6.1.10
Severity Score:
Medium
CVE:
2025-39589
The vulnerability has been patched, so you should update to version 6.1.10.

Essential Addons for Elementor – Popular Elementor Addon With Ready Templates, Advanced Widgets, Kits & WooCommerce Builders

Plugin:
Essential Addons for Elementor – Popular Elementor Addon With Ready Templates, Advanced Widgets, Kits & WooCommerce Builders
Plugin Slug:
essential-addons-for-elementor-lite
Installations
2,000,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
6.1.10
Severity Score:
Medium
CVE:
2025-39590
The vulnerability has been patched, so you should update to version 6.1.10.

Ocean Extra

Plugin:
Ocean Extra
Plugin Slug:
ocean-extra
Installations
600,000+
Vulnerability:
Content Injection
Patched in Version:
2.4.7
Severity Score:
Medium
CVE:
2025-3472
The vulnerability has been patched, so you should update to version 2.4.7.

Ocean Extra

Plugin:
Ocean Extra
Plugin Slug:
ocean-extra
Installations
600,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.4.7
Severity Score:
Medium
CVE:
2025-3457
The vulnerability has been patched, so you should update to version 2.4.7.

Royal Elementor Addons and Templates

Plugin:
Royal Elementor Addons and Templates
Plugin Slug:
royal-elementor-addons
Installations
600,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.3.979
Severity Score:
Medium
CVE:
2025-39543
The vulnerability has been patched, so you should update to version 1.3.979.

Password Protected – Password Protect your WordPress Site, Pages, & WooCommerce Products – Restrict Content, Protect WooCommerce Category and more

Plugin:
Password Protected – Password Protect your WordPress Site, Pages, & WooCommerce Products – Restrict Content, Protect WooCommerce Category and more
Plugin Slug:
password-protected
Installations
300,000+
Vulnerability:
Sensitive Data Exposure
Patched in Version:
2.7.8
Severity Score:
Medium
CVE:
2025-3453
The vulnerability has been patched, so you should update to version 2.7.8.

Insert Headers And Footers

Plugin:
Insert Headers And Footers
Plugin Slug:
wp-headers-and-footers
Installations
200,000+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
3.1.2
Severity Score:
High
CVE:
2025-2111
The vulnerability has been patched, so you should update to version 3.1.2.

Element Pack Addons for Elementor – Best Elementor addons with Ready Templates, Blocks, Widgets and WooCommerce Builder

Plugin:
Element Pack Addons for Elementor – Best Elementor addons with Ready Templates, Blocks, Widgets and WooCommerce Builder
Plugin Slug:
bdthemes-element-pack-lite
Installations
100,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
5.10.29
Severity Score:
Medium
CVE:
2025-1457
The vulnerability has been patched, so you should update to version 5.10.29.

Download Manager

Plugin:
Download Manager
Plugin Slug:
download-manager
Installations
100,000+
Vulnerability:
Arbitrary File Deletion
Patched in Version:
3.3.13
Severity Score:
Medium
CVE:
2025-3404
The vulnerability has been patched, so you should update to version 3.3.13.

Download Manager

Plugin:
Download Manager
Plugin Slug:
download-manager
Installations
100,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.3.13
Severity Score:
Medium
CVE:
2025-3056
The vulnerability has been patched, so you should update to version 3.3.13.

Kadence WooCommerce Email Designer

Plugin:
Kadence WooCommerce Email Designer
Plugin Slug:
kadence-woocommerce-email-designer
Installations
100,000+
Vulnerability:
Arbitrary File Upload
Patched in Version:
1.5.15
Severity Score:
Critical
CVE:
2025-39557
The vulnerability has been patched, so you should update to version 1.5.15.

Social Sharing Plugin – Sassy Social Share

Plugin:
Social Sharing Plugin – Sassy Social Share
Plugin Slug:
sassy-social-share
Installations
100,000+
Vulnerability:
Open Redirection
Patched in Version:
3.3.74
Severity Score:
Medium
CVE:
2025-39404
The vulnerability has been patched, so you should update to version 3.3.74.

WordPress Button Plugin MaxButtons

Plugin:
WordPress Button Plugin MaxButtons
Plugin Slug:
maxbuttons
Installations
90,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
9.8.4
Severity Score:
Medium
CVE:
2025-39444
The vulnerability has been patched, so you should update to version 9.8.4.

Widget for Social Page Feeds

Plugin:
Widget for Social Page Feeds
Plugin Slug:
facebook-pagelike-widget
Installations
60,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
6.4.2
Severity Score:
Medium
CVE:
2024-13207
The vulnerability has been patched, so you should update to version 6.4.2.

Ultimate Dashboard – Custom WordPress Dashboard

Plugin:
Ultimate Dashboard – Custom WordPress Dashboard
Plugin Slug:
ultimate-dashboard
Installations
60,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.8.6
Severity Score:
Medium
CVE:
2025-1523
The vulnerability has been patched, so you should update to version 3.8.6.

Greenshift – animation and page builder blocks

Plugin:
Greenshift – animation and page builder blocks
Plugin Slug:
greenshift-animation-and-page-builder-blocks
Installations
50,000+
Vulnerability:
Arbitrary File Upload
Patched in Version:
11.4.6
Severity Score:
High
CVE:
2025-3616
The vulnerability has been patched, so you should update to version 11.4.6.

WP Import Export Lite

Plugin:
WP Import Export Lite
Plugin Slug:
wp-import-export-lite
Installations
50,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.9.28
Severity Score:
Medium
CVE:
2025-2839
The vulnerability has been patched, so you should update to version 3.9.28.

MapPress Maps for WordPress

Plugin:
MapPress Maps for WordPress
Plugin Slug:
mappress-google-maps-for-wordpress
Installations
40,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.94.10
Severity Score:
Medium
CVE:
2025-2162
The vulnerability has been patched, so you should update to version 2.94.10.

Contact Form & SMTP Plugin for WordPress by PirateForms

Plugin:
Contact Form & SMTP Plugin for WordPress by PirateForms
Plugin Slug:
pirate-forms
Installations
40,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.6.0
Severity Score:
Medium
CVE:
2024-11273
The vulnerability has been patched, so you should update to version 2.6.0.

Themesflat Addons For Elementor

Plugin:
Themesflat Addons For Elementor
Plugin Slug:
themesflat-addons-for-elementor
Installations
40,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.2.6
Severity Score:
Medium
CVE:
2025-3275
The vulnerability has been patched, so you should update to version 2.2.6.

Cost Calculator Builder

Plugin:
Cost Calculator Builder
Plugin Slug:
cost-calculator-builder
Installations
30,000+
Vulnerability:
SQL Injection
Patched in Version:
3.2.68
Severity Score:
Critical
CVE:
2025-39587
The vulnerability has been patched, so you should update to version 3.2.68.

Social Slider Feed

Plugin:
Social Slider Feed
Plugin Slug:
instagram-slider-widget
Installations
30,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.2.9
Severity Score:
Medium
CVE:
2025-0717
The vulnerability has been patched, so you should update to version 2.2.9.

PowerPress Podcasting plugin by Blubrry

Plugin:
PowerPress Podcasting plugin by Blubrry
Plugin Slug:
powerpress
Installations
30,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
11.9.18
Severity Score:
Medium
CVE:
2024-9230
The vulnerability has been patched, so you should update to version 11.9.18.

WP Editor

Plugin:
WP Editor
Plugin Slug:
wp-editor
Installations
30,000+
Vulnerability:
Directory Traversal
Patched in Version:
1.2.9.2
Severity Score:
Medium
CVE:
2025-3295
The vulnerability has been patched, so you should update to version 1.2.9.2.

WP Editor

Plugin:
WP Editor
Plugin Slug:
wp-editor
Installations
30,000+
Vulnerability:
Directory Traversal
Patched in Version:
1.2.9.2
Severity Score:
High
CVE:
2025-3294
The vulnerability has been patched, so you should update to version 1.2.9.2.

Advanced Dynamic Pricing for WooCommerce

Plugin:
Advanced Dynamic Pricing for WooCommerce
Plugin Slug:
advanced-dynamic-pricing-for-woocommerce
Installations
20,000+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
4.9.5
Severity Score:
Medium
CVE:
2025-39453
The vulnerability has been patched, so you should update to version 4.9.5.

Docket Cache – Object Cache Accelerator

Plugin:
Docket Cache – Object Cache Accelerator
Plugin Slug:
docket-cache
Installations
20,000+
Vulnerability:
Local File Inclusion
Patched in Version:
24.07.03
Severity Score:
High
CVE:
2025-39461
The vulnerability has been patched, so you should update to version 24.07.03.

WordPress REST API Authentication

Plugin:
WordPress REST API Authentication
Plugin Slug:
wp-rest-api-authentication
Installations
20,000+
Vulnerability:
Settings Change
Patched in Version:
3.6.4
Severity Score:
Medium
CVE:
2025-39545
The vulnerability has been patched, so you should update to version 3.6.4.

WP Simple Booking Calendar

Plugin:
WP Simple Booking Calendar
Plugin Slug:
wp-simple-booking-calendar
Installations
20,000+
Vulnerability:
Broken Access Control
Patched in Version:
2.0.14
Severity Score:
Medium
CVE:
2025-39541
The vulnerability has been patched, so you should update to version 2.0.14.

AFI – The Easiest Integration Plugin

Plugin:
AFI – The Easiest Integration Plugin
Plugin Slug:
advanced-form-integration
Installations
10,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.100.0
Severity Score:
Medium
CVE:
2024-13123
The vulnerability has been patched, so you should update to version 1.100.0.

Conditional Payments for WooCommerce

Plugin:
Conditional Payments for WooCommerce
Plugin Slug:
conditional-payments-for-woocommerce
Installations
10,000+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
3.3.1
Severity Score:
Medium
CVE:
2025-39563
The vulnerability has been patched, so you should update to version 3.3.1.

Conditional Shipping for WooCommerce

Plugin:
Conditional Shipping for WooCommerce
Plugin Slug:
conditional-shipping-for-woocommerce
Installations
10,000+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
3.4.1
Severity Score:
Medium
CVE:
2025-39564
The vulnerability has been patched, so you should update to version 3.4.1.

HTML5 Audio Player- Best WordPress Audio Player Plugin

Plugin:
HTML5 Audio Player- Best WordPress Audio Player Plugin
Plugin Slug:
html5-audio-player
Installations
10,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.3.0
Severity Score:
Medium
CVE:
2025-39524
The vulnerability has been patched, so you should update to version 2.3.0.

Klarna Checkout for WooCommerce

Plugin:
Klarna Checkout for WooCommerce
Plugin Slug:
klarna-checkout-for-woocommerce
Installations
10,000+
Vulnerability:
Denial of Service Attack
Patched in Version:
2.13.5
Severity Score:
High
CVE:
2024-13925
The vulnerability has been patched, so you should update to version 2.13.5.

Mediavine Control Panel

Plugin:
Mediavine Control Panel
Plugin Slug:
mediavine-control-panel
Installations
10,000+
Vulnerability:
Sensitive Data Exposure
Patched in Version:
2.10.7
Severity Score:
Medium
CVE:
2025-39556
The vulnerability has been patched, so you should update to version 2.10.7.

WooCommerce Product Table Lite

Plugin:
WooCommerce Product Table Lite
Plugin Slug:
wc-product-table-lite
Installations
10,000+
Vulnerability:
Broken Access Control
Patched in Version:
3.9.6
Severity Score:
Medium
CVE:
2025-39602
The vulnerability has been patched, so you should update to version 3.9.6.

Themify Shortcodes

Plugin:
Themify Shortcodes
Plugin Slug:
themify-shortcodes
Installations
9,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.1.4
Severity Score:
Medium
CVE:
2025-39581
The vulnerability has been patched, so you should update to version 2.1.4.

Contact Form by Supsystic

Plugin:
Contact Form by Supsystic
Plugin Slug:
contact-form-by-supsystic
Installations
8,000+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
1.7.30
Severity Score:
High
CVE:
2024-13452
The vulnerability has been patched, so you should update to version 1.7.30.

Debug Log Manager

Plugin:
Debug Log Manager
Plugin Slug:
debug-log-manager
Installations
7,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.3.5
Severity Score:
High
CVE:
2025-32613
The vulnerability has been patched, so you should update to version 2.3.5.

ProfileGrid – User Profiles, Groups and Communities

Plugin:
ProfileGrid – User Profiles, Groups and Communities
Plugin Slug:
profilegrid-user-profiles-groups-and-communities
Installations
7,000+
Vulnerability:
SQL Injection
Patched in Version:
5.9.4.9
Severity Score:
High
CVE:
2025-39586
The vulnerability has been patched, so you should update to version 5.9.4.9.

Drag and Drop Multiple File Upload for WooCommerce

Plugin:
Drag and Drop Multiple File Upload for WooCommerce
Plugin Slug:
drag-and-drop-multiple-file-upload-for-woocommerce
Installations
6,000+
Vulnerability:
Arbitrary File Deletion
Patched in Version:
1.1.5
Severity Score:
Critical
CVE:
2025-2941
The vulnerability has been patched, so you should update to version 1.1.5.

Coupon Affiliates – Affiliate Plugin for WooCommerce

Plugin:
Coupon Affiliates – Affiliate Plugin for WooCommerce
Plugin Slug:
woo-coupon-usage
Installations
5,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
6.3.1
Severity Score:
High
CVE:
2025-3598
The vulnerability has been patched, so you should update to version 6.3.1.

WPAdverts – Classifieds Plugin

Plugin:
WPAdverts – Classifieds Plugin
Plugin Slug:
wpadverts
Installations
5,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.2.2
Severity Score:
Medium
CVE:
2025-39576
The vulnerability has been patched, so you should update to version 2.2.2.

Logo Carousel Gutenberg Block

Plugin:
Logo Carousel Gutenberg Block
Plugin Slug:
awesome-logo-carousel-block
Installations
4,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.1.7
Severity Score:
Medium
CVE:
2025-2083
The vulnerability has been patched, so you should update to version 2.1.7.

ElementsReady Addons for Elementor

Plugin:
ElementsReady Addons for Elementor
Plugin Slug:
element-ready-lite
Installations
4,000+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
6.6.3
Severity Score:
Medium
CVE:
2025-39546
The vulnerability has been patched, so you should update to version 6.6.3.

Responsive Blocks – WordPress Gutenberg Blocks

Plugin:
Responsive Blocks – WordPress Gutenberg Blocks
Plugin Slug:
responsive-block-editor-addons
Installations
4,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.0.3
Severity Score:
Medium
CVE:
2025-39578
The vulnerability has been patched, so you should update to version 2.0.3.

WP Posts Carousel

Plugin:
WP Posts Carousel
Plugin Slug:
wp-posts-carousel
Installations
4,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.3.11
Severity Score:
Medium
CVE:
2025-39573
The vulnerability has been patched, so you should update to version 1.3.11.

Name Directory

Plugin:
Name Directory
Plugin Slug:
name-directory
Installations
3,000+
Vulnerability:
Broken Access Control
Patched in Version:
1.30.1
Severity Score:
Medium
CVE:
2025-39454
The vulnerability has been patched, so you should update to version 1.30.1.

Property Hive

Plugin:
Property Hive
Plugin Slug:
propertyhive
Installations
3,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.1.3
Severity Score:
Medium
CVE:
2025-39577
The vulnerability has been patched, so you should update to version 2.1.3.

GoodBarber

Plugin:
GoodBarber
Plugin Slug:
goodbarber
Installations
2,000+
Vulnerability:
Open Redirection
Patched in Version:
1.0.27
Severity Score:
Medium
CVE:
2025-39523
The vulnerability has been patched, so you should update to version 1.0.27.

MelaPress Login Security

Plugin:
MelaPress Login Security
Plugin Slug:
melapress-login-security
Installations
2,000+
Vulnerability:
PHP Object Injection
Patched in Version:
2.1.1
Severity Score:
Medium
CVE:
2025-39565
The vulnerability has been patched, so you should update to version 2.1.1.

SKT Blocks – Gutenberg based Page Builder

Plugin:
SKT Blocks – Gutenberg based Page Builder
Plugin Slug:
skt-blocks
Installations
2,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.0
Severity Score:
Medium
CVE:
2025-3276
The vulnerability has been patched, so you should update to version 2.0.

WPCOM Member

Plugin:
WPCOM Member
Plugin Slug:
wpcom-member
Installations
2,000+
Vulnerability:
Local File Inclusion
Patched in Version:
1.7.8
Severity Score:
High
CVE:
2025-39570
The vulnerability has been patched, so you should update to version 1.7.8.

Membership For WooCommerce

Plugin:
Membership For WooCommerce
Plugin Slug:
membership-for-woocommerce
Installations
1,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.8.1
Severity Score:
Medium
CVE:
2025-39579
The vulnerability has been patched, so you should update to version 2.8.1.

Most And Least Read Posts Widget

Plugin:
Most And Least Read Posts Widget
Plugin Slug:
most-and-least-read-posts-widget
Installations
1,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.5.21
Severity Score:
Medium
CVE:
2025-39549
The vulnerability has been patched, so you should update to version 2.5.21.

Sign-up Sheets

Plugin:
Sign-up Sheets
Plugin Slug:
sign-up-sheets
Installations
1,000+
Vulnerability:
Content Injection
Patched in Version:
2.3.1
Severity Score:
Medium
CVE:
2025-26996
The vulnerability has been patched, so you should update to version 2.3.1.

Smart Maintenance Mode

Plugin:
Smart Maintenance Mode
Plugin Slug:
smart-maintenance-mode
Installations
1,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.5.2
Severity Score:
Medium
CVE:
2024-12683
The vulnerability has been patched, so you should update to version 1.5.2.

Tourfic Toolkit

Plugin:
Tourfic Toolkit
Plugin Slug:
travelfic-toolkit
Installations
1,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.2.3
Severity Score:
Medium
CVE:
2025-39585
The vulnerability has been patched, so you should update to version 1.2.3.

Ever Accounting – WordPress Accounting and Invoice Plugin

Plugin:
Ever Accounting – WordPress Accounting and Invoice Plugin
Plugin Slug:
wp-ever-accounting
Installations
1,000+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
2.1.6
Severity Score:
Medium
CVE:
2025-39593
The vulnerability has been patched, so you should update to version 2.1.6.

Integration for WooCommerce and QuickBooks

Plugin:
Integration for WooCommerce and QuickBooks
Plugin Slug:
wp-woocommerce-quickbooks
Installations
1,000+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
1.3.2
Severity Score:
Medium
CVE:
2025-39600
The vulnerability has been patched, so you should update to version 1.3.2.

WPCasa

Plugin:
WPCasa
Plugin Slug:
wpcasa
Installations
1,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.4.0
Severity Score:
Medium
CVE:
2025-39575
The vulnerability has been patched, so you should update to version 1.4.0.

Zephyr Project Manager

Plugin:
Zephyr Project Manager
Plugin Slug:
zephyr-project-manager
Installations
1,000+
Vulnerability:
Broken Access Control
Patched in Version:
3.3.201
Severity Score:
Medium
CVE:
2025-39552
The vulnerability has been patched, so you should update to version 3.3.201.

Arigato Autoresponder and Newsletter

Plugin:
Arigato Autoresponder and Newsletter
Plugin Slug:
bft-autoresponder
Installations
900+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.7.2.5
Severity Score:
High
CVE:
2025-39594
The vulnerability has been patched, so you should update to version 2.7.2.5.

Church Admin

Plugin:
Church Admin
Plugin Slug:
church-admin
Installations
900+
Vulnerability:
Sensitive Data Exposure
Patched in Version:
5.0.10
Severity Score:
Medium
CVE:
2025-39553
The vulnerability has been patched, so you should update to version 5.0.10.

Church Admin

Plugin:
Church Admin
Plugin Slug:
church-admin
Installations
900+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
5.0.24
Severity Score:
Medium
CVE:
2025-39555
The vulnerability has been patched, so you should update to version 5.0.24.

Checkout for PayPal

Plugin:
Checkout for PayPal
Plugin Slug:
checkout-for-paypal
Installations
700+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.0.39
Severity Score:
Medium
CVE:
2025-39572
The vulnerability has been patched, so you should update to version 1.0.39.

OTP-less one tap Sign in

Plugin:
OTP-less one tap Sign in
Plugin Slug:
otpless
Installations
700+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.0.59
Severity Score:
High
CVE:
2025-32622
The vulnerability has been patched, so you should update to version 2.0.59.

BERTHA AI. Your AI co-pilot for WordPress and Chrome

Plugin:
BERTHA AI. Your AI co-pilot for WordPress and Chrome
Plugin Slug:
bertha-ai-free
Installations
600+
Vulnerability:
Arbitrary Content Deletion
Patched in Version:
1.12.11
Severity Score:
High
CVE:
2025-39583
The vulnerability has been patched, so you should update to version 1.12.11.

Bring Fraktguiden for WooCommerce

Plugin:
Bring Fraktguiden for WooCommerce
Plugin Slug:
bring-fraktguiden-for-woocommerce
Installations
600+
Vulnerability:
Broken Access Control
Patched in Version:
1.11.5
Severity Score:
Medium
CVE:
2025-39559
The vulnerability has been patched, so you should update to version 1.11.5.

Verge3D Publishing and E-Commerce

Plugin:
Verge3D Publishing and E-Commerce
Plugin Slug:
verge3d
Installations
600+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
4.9.3
Severity Score:
Medium
CVE:
2025-39443
The vulnerability has been patched, so you should update to version 4.9.3.

Cloak Front End Email

Plugin:
Cloak Front End Email
Plugin Slug:
cloak-front-end-email
Installations
500+
Vulnerability:
Broken Access Control
Patched in Version:
1.9.6
Severity Score:
High
CVE:
2025-26968
The vulnerability has been patched, so you should update to version 1.9.6.

Quentn WP

Plugin:
Quentn WP
Plugin Slug:
quentn-wp
Installations
500+
Vulnerability:
SQL Injection
Patched in Version:
1.2.9
Severity Score:
Critical
CVE:
2025-39595
The vulnerability has been patched, so you should update to version 1.2.9.

Quentn WP

Plugin:
Quentn WP
Plugin Slug:
quentn-wp
Installations
500+
Vulnerability:
Privilege Escalation
Patched in Version:
1.2.9
Severity Score:
Critical
CVE:
2025-39596
The vulnerability has been patched, so you should update to version 1.2.9.

Web Directory Free

Plugin:
Web Directory Free
Plugin Slug:
web-directory-free
Installations
500+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.7.9
Severity Score:
High
CVE:
2025-39567
The vulnerability has been patched, so you should update to version 1.7.9.

Administrator Z

Plugin:
Administrator Z
Plugin Slug:
administrator-z
Installations
400+
Vulnerability:
Directory Traversal
Patched in Version:
2025.03.30
Severity Score:
Medium
CVE:
2025-39598
The vulnerability has been patched, so you should update to version 2025.03.30.

Administrator Z

Plugin:
Administrator Z
Plugin Slug:
administrator-z
Installations
400+
Vulnerability:
Privilege Escalation
Patched in Version:
2025.03.27
Severity Score:
High
CVE:
2025-26959
The vulnerability has been patched, so you should update to version 2025.03.27.

Custom CSS, JS & PHP

Plugin:
Custom CSS, JS & PHP
Plugin Slug:
custom-css
Installations
400+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
2.4.2
Severity Score:
Critical
CVE:
2025-39601
The vulnerability has been patched, so you should update to version 2.4.2.

Uix Shortcodes

Plugin:
Uix Shortcodes
Plugin Slug:
uix-shortcodes
Installations
400+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.0.5
Severity Score:
Medium
CVE:
2025-39574
The vulnerability has been patched, so you should update to version 2.0.5.

Sell access, Automate, and add Engaging Exclusive Discord Access: Introducing the MemberPress Discord Addon — Elevate Your Community!

Plugin:
Sell access, Automate, and add Engaging Exclusive Discord Access: Introducing the MemberPress Discord Addon — Elevate Your Community!
Plugin Slug:
expresstechsoftwares-memberpress-discord-add-on
Installations
300+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.1.2
Severity Score:
High
CVE:
2025-32605
The vulnerability has been patched, so you should update to version 1.1.2.

Fast eBay Listings

Plugin:
Fast eBay Listings
Plugin Slug:
fast-ebay-listings
Installations
300+
Vulnerability:
Open Redirection
Patched in Version:
2.12.16
Severity Score:
Medium
CVE:
2025-39597
The vulnerability has been patched, so you should update to version 2.12.16.

TableOn – WordPress Posts Table Filterable 

Plugin:
TableOn – WordPress Posts Table Filterable 
Plugin Slug:
posts-table-filterable
Installations
300+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.0.4
Severity Score:
High
CVE:
2025-32592
The vulnerability has been patched, so you should update to version 1.0.4.

SB Chart block

Plugin:
SB Chart block
Plugin Slug:
sb-chart-block
Installations
300+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.3.1
Severity Score:
Medium
CVE:
2025-3661
The vulnerability has been patched, so you should update to version 1.3.1.

Tax Switch for WooCommerce

Plugin:
Tax Switch for WooCommerce
Plugin Slug:
tax-switch-for-woocommerce
Installations
300+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.4.3
Severity Score:
Medium
CVE:
2025-3814
The vulnerability has been patched, so you should update to version 1.4.3.

WP Logger

Plugin:
WP Logger
Plugin Slug:
wp-data-logger
Installations
300+
Vulnerability:
Broken Access Control
Patched in Version:
2.2.1
Severity Score:
Medium
CVE:
2025-39456
The vulnerability has been patched, so you should update to version 2.2.1.

AdminQuickbar

Plugin:
AdminQuickbar
Plugin Slug:
adminquickbar
Installations
200+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.9.2
Severity Score:
High
CVE:
2025-39464
The vulnerability has been patched, so you should update to version 1.9.2.

Feedify – Web Push Notifications

Plugin:
Feedify – Web Push Notifications
Plugin Slug:
push-notification-by-feedify
Installations
200+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.4.6
Severity Score:
High
CVE:
2025-32540
The vulnerability has been patched, so you should update to version 2.4.6.

Total processing card payments for WooCommerce

Plugin:
Total processing card payments for WooCommerce
Plugin Slug:
totalprocessing-card-payments
Installations
200+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
7.1.7
Severity Score:
High
CVE:
2025-32513
The vulnerability has been patched, so you should update to version 7.1.7.

Dashi

Plugin:
Dashi
Plugin Slug:
dashi
Installations
100+
Vulnerability:
Broken Access Control
Patched in Version:
3.1.9
Severity Score:
Medium
CVE:
2025-39580
The vulnerability has been patched, so you should update to version 3.1.9.

WordPress Internal Link Optimiser

Plugin:
WordPress Internal Link Optimiser
Plugin Slug:
internal-link-finder
Installations
100+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
5.1.4
Severity Score:
High
CVE:
2025-39547
The vulnerability has been patched, so you should update to version 5.1.4.

IP2Location Variables

Plugin:
IP2Location Variables
Plugin Slug:
ip2location-variables
Installations
100+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
2.9.6
Severity Score:
High
CVE:
2025-39455
The vulnerability has been patched, so you should update to version 2.9.6.

Right Click Disable OR Ban

Plugin:
Right Click Disable OR Ban
Plugin Slug:
right-click-disable-or-ban
Installations
100+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
1.2.0
Severity Score:
High
CVE:
2025-39548
The vulnerability has been patched, so you should update to version 1.2.0.

Verowa Connect

Plugin:
Verowa Connect
Plugin Slug:
verowa-connect
Installations
100+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.0.5
Severity Score:
High
CVE:
2025-32609
The vulnerability has been patched, so you should update to version 3.0.5.

Email Notifications for Updates

Plugin:
Email Notifications for Updates
Plugin Slug:
wp-update-mail-notification
Installations
100+
Vulnerability:
Privilege Escalation
Patched in Version:
1.2.0
Severity Score:
High
CVE:
2025-26741
The vulnerability has been patched, so you should update to version 1.2.0.

Material Dashboard

Plugin:
Material Dashboard
Plugin Slug:
material-dashboard
Installations
80+
Vulnerability:
Privilege Escalation
Patched in Version:
1.4.7
Severity Score:
Critical
CVE:
2025-32486
The vulnerability has been patched, so you should update to version 1.4.7.

AI Text to Speech – TTS Plugin For WordPress

Plugin:
AI Text to Speech – TTS Plugin For WordPress
Plugin Slug:
ai-text-to-speech
Installations
70+
Vulnerability:
Broken Access Control
Patched in Version:
3.0.4
Severity Score:
Medium
CVE:
2025-39554
The vulnerability has been patched, so you should update to version 3.0.4.

Hostel

Plugin:
Hostel
Plugin Slug:
hostel
Installations
60+
Vulnerability:
SQL Injection
Patched in Version:
1.1.5.7
Severity Score:
High
CVE:
2025-39566
The vulnerability has been patched, so you should update to version 1.1.5.7.

StoreContrl Woocommerce

Plugin:
StoreContrl Woocommerce
Plugin Slug:
storecontrl-wp-connection
Installations
60+
Vulnerability:
Arbitrary File Download
Patched in Version:
4.1.4
Severity Score:
High
CVE:
2025-39568
The vulnerability has been patched, so you should update to version 4.1.4.

Smart Agreements

Plugin:
Smart Agreements
Plugin Slug:
smart-agreements
Installations
40+
Vulnerability:
Local File Inclusion
Patched in Version:
1.0.4
Severity Score:
High
CVE:
2025-39462
The vulnerability has been patched, so you should update to version 1.0.4.

Payment Form for PayPal Pro

Plugin:
Payment Form for PayPal Pro
Plugin Slug:
payment-form-for-paypal-pro
Installations
30+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.1.73
Severity Score:
Medium
CVE:
2025-39562
The vulnerability has been patched, so you should update to version 1.1.73.

AnalyticsWP

Plugin:
AnalyticsWP
Plugin Slug:
analyticswp
Vulnerability:
SQL Injection
Patched in Version:
2.1.5
Severity Score:
Critical
CVE:
2025-39389
The vulnerability has been patched, so you should update to version 2.1.5.

Booster Plus for WooCommerce

Plugin:
Booster Plus for WooCommerce
Plugin Slug:
booster-plus-for-woocommerce
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
7.2.5
Severity Score:
High
CVE:
2025-39446
The vulnerability has been patched, so you should update to version 7.2.5.

FS Poster

Plugin:
FS Poster
Plugin Slug:
fs-poster
Vulnerability:
Broken Access Control
Patched in Version:
7.1.8
Severity Score:
High
CVE:
2025-30960
The vulnerability has been patched, so you should update to version 7.1.8.

JetBlocks For Elementor

Plugin:
JetBlocks For Elementor
Plugin Slug:
jet-blocks
Vulnerability:
Broken Access Control
Patched in Version:
1.3.16.1
Severity Score:
High
CVE:
2025-39451
The vulnerability has been patched, so you should update to version 1.3.16.1.

JetBlog

Plugin:
JetBlog
Plugin Slug:
jet-blog
Vulnerability:
Broken Access Control
Patched in Version:
2.4.3.1
Severity Score:
High
CVE:
2025-26958
The vulnerability has been patched, so you should update to version 2.4.3.1.

JetElements For Elementor

Plugin:
JetElements For Elementor
Plugin Slug:
jet-elements
Vulnerability:
Broken Access Control
Patched in Version:
2.7.4.2
Severity Score:
High
CVE:
2025-39447
The vulnerability has been patched, so you should update to version 2.7.4.2.

JetElements For Elementor

Plugin:
JetElements For Elementor
Plugin Slug:
jet-elements
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.7.4.2
Severity Score:
Medium
CVE:
2025-39448
The vulnerability has been patched, so you should update to version 2.7.4.2.

JetMenu

Plugin:
JetMenu
Plugin Slug:
jet-menu
Vulnerability:
Broken Access Control
Patched in Version:
2.4.9.1
Severity Score:
High
CVE:
2025-26953
The vulnerability has been patched, so you should update to version 2.4.9.1.

JetPopup

Plugin:
JetPopup
Plugin Slug:
jet-popup
Vulnerability:
Broken Access Control
Patched in Version:
2.0.12
Severity Score:
High
CVE:
2025-26944
The vulnerability has been patched, so you should update to version 2.0.12.

JetReviews

Plugin:
JetReviews
Plugin Slug:
jet-reviews
Vulnerability:
Local File Inclusion
Patched in Version:
2.3.7
Severity Score:
High
CVE:
2025-39396
The vulnerability has been patched, so you should update to version 2.3.7.

JetTabs

Plugin:
JetTabs
Plugin Slug:
jet-tabs
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.2.8
Severity Score:
Medium
CVE:
2025-39450
The vulnerability has been patched, so you should update to version 2.2.8.

JetTricks

Plugin:
JetTricks
Plugin Slug:
jet-tricks
Vulnerability:
Broken Access Control
Patched in Version:
1.5.1.1
Severity Score:
High
CVE:
2025-26942
The vulnerability has been patched, so you should update to version 1.5.1.1.

JetWooBuilder

Plugin:
JetWooBuilder
Plugin Slug:
jet-woo-builder
Vulnerability:
Broken Access Control
Patched in Version:
2.1.18.1
Severity Score:
High
CVE:
2025-39449
The vulnerability has been patched, so you should update to version 2.1.18.1.

CLEVER

Plugin:
CLEVER
Plugin Slug:
lbg-audio11-html5-shoutcast_history
Vulnerability:
Path Traversal
Patched in Version:
2.5
Severity Score:
High
CVE:
2025-3103
The vulnerability has been patched, so you should update to version 2.5.

Live Forms

Plugin:
Live Forms
Plugin Slug:
liveforms
Vulnerability:
Broken Access Control
Patched in Version:
4.8.5
Severity Score:
Medium
CVE:
2025-39560
The vulnerability has been patched, so you should update to version 4.8.5.

Smart Product Review

Plugin:
Smart Product Review
Plugin Slug:
smart-product-review
Vulnerability:
Arbitrary File Upload
Patched in Version:
1.0.5
Severity Score:
Critical
CVE:
2021-4455
The vulnerability has been patched, so you should update to version 1.0.5.

Super Store Finder

Plugin:
Super Store Finder
Plugin Slug:
superstorefinder-wp
Vulnerability:
SQL Injection
Patched in Version:
7.5
Severity Score:
Critical
CVE:
2025-39445
The vulnerability has been patched, so you should update to version 7.5.

Tourmaster

Plugin:
Tourmaster
Plugin Slug:
tourmaster
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
5.4.1
Severity Score:
High
CVE:
2025-32923
The vulnerability has been patched, so you should update to version 5.4.1.

Unlimited Timeline

Plugin:
Unlimited Timeline
Plugin Slug:
unlimited-timeline
Vulnerability:
Broken Access Control
Patched in Version:
1.6.1
Severity Score:
High
CVE:
2025-27008
The vulnerability has been patched, so you should update to version 1.6.1.

UrbanGo Membership

Plugin:
UrbanGo Membership
Plugin Slug:
urbango-membership
Vulnerability:
Privilege Escalation
Patched in Version:
1.1
Severity Score:
Critical
CVE:
2025-3278
The vulnerability has been patched, so you should update to version 1.1.

User Registration & Membership Pro

Plugin:
User Registration & Membership Pro
Plugin Slug:
user-registration-pro
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
5.2.0
Severity Score:
Medium
CVE:
2025-3284
The vulnerability has been patched, so you should update to version 5.2.0.

Vitepos

Plugin:
Vitepos
Plugin Slug:
vitepos-lite
Vulnerability:
Broken Authentication
Patched in Version:
3.1.8
Severity Score:
High
CVE:
2025-39535
The vulnerability has been patched, so you should update to version 3.1.8.

Advanced Google Maps

Plugin:
Advanced Google Maps
Plugin Slug:
wp-google-map-gold
Vulnerability:
Broken Access Control
Patched in Version:
5.8.5
Severity Score:
Medium
CVE:
2025-39465
The vulnerability has been patched, so you should update to version 5.8.5.

Wp Staging Pro

Plugin:
Wp Staging Pro
Plugin Slug:
wp-staging-pro
Vulnerability:
Sensitive Data Exposure
Patched in Version:
6.1.3
Severity Score:
Medium
CVE:
2025-3104
The vulnerability has been patched, so you should update to version 6.1.3.

WordPress Themes — 9 Patched / 16 Unpatched

Arrival

Theme:
Arrival
Theme Slug:
arrival
Downloads
126,390
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-32921
The vulnerability has not been patched. You should switch themes.

CWW Portfolio

Theme:
CWW Portfolio
Theme Slug:
cww-portfolio
Downloads
85,610
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-39359
The vulnerability has not been patched. You should switch themes.

Grace Mag

Theme:
Grace Mag
Theme Slug:
grace-mag
Downloads
70,093
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-39360
The vulnerability has not been patched. You should switch themes.

Opstore

Theme:
Opstore
Theme Slug:
opstore
Downloads
82,183
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-39387
The vulnerability has not been patched. You should switch themes.

Sirat

Theme:
Sirat
Theme Slug:
sirat
Downloads
355,294
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-39385
The vulnerability has not been patched. You should switch themes.

Xews Lite

Theme:
Xews Lite
Theme Slug:
xews-lite
Downloads
14,599
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-39383
The vulnerability has not been patched. You should switch themes.

Altair

Theme:
Altair
Theme Slug:
altair
Vulnerability:
PHP Object Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2025-32928
The vulnerability has not been patched. You should switch themes.

Celestial Aura

Theme:
Celestial Aura
Theme Slug:
celestial-aura
Vulnerability:
Arbitrary File Upload
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2025-26892
The vulnerability has not been patched. You should switch themes.

CiyaShop

Theme:
CiyaShop
Theme Slug:
ciyashop
Vulnerability:
PHP Object Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2025-39349
The vulnerability has not been patched. You should switch themes.

Eximius

Theme:
Eximius
Theme Slug:
eximius
Vulnerability:
Arbitrary File Upload
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2025-26872
The vulnerability has not been patched. You should switch themes.

Grand Restaurant WordPress

Theme:
Grand Restaurant WordPress
Theme Slug:
grandrestaurant
Vulnerability:
PHP Object Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2025-39348
The vulnerability has not been patched. You should switch themes.

Grand Restaurant WordPress

Theme:
Grand Restaurant WordPress
Theme Slug:
grandrestaurant
Vulnerability:
Arbitrary Content Deletion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-39352
The vulnerability has not been patched. You should switch themes.

Grand Restaurant WordPress

Theme:
Grand Restaurant WordPress
Theme Slug:
grandrestaurant
Vulnerability:
Path Traversal
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2025-32926
The vulnerability has not been patched. You should switch themes.

Grand Restaurant WordPress

Theme:
Grand Restaurant WordPress
Theme Slug:
grandrestaurant
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-39351
The vulnerability has not been patched. You should switch themes.

Grand Restaurant WordPress

Theme:
Grand Restaurant WordPress
Theme Slug:
grandrestaurant
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-39353
The vulnerability has not been patched. You should switch themes.

Grip

Theme:
Grip
Theme Slug:
grip
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-26735
The vulnerability has not been patched. You should switch themes.

Betheme

Theme:
Betheme
Theme Slug:
betheme
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
28.0.4
Severity Score:
Medium
CVE:
2025-3077
The vulnerability has been patched, so you should update to version 28.0.4.

Dessau

Theme:
Dessau
Theme Slug:
dessau
Vulnerability:
Local File Inclusion
Patched in Version:
1.9
Severity Score:
High
CVE:
2025-39463
The vulnerability has been patched, so you should update to version 1.9.

Dør

Theme:
Dør
Theme Slug:
dor
Vulnerability:
Local File Inclusion
Patched in Version:
2.4.1
Severity Score:
High
CVE:
2025-39466
The vulnerability has been patched, so you should update to version 2.4.1.

Eduma

Theme:
Eduma
Theme Slug:
eduma
Vulnerability:
Broken Access Control
Patched in Version:
5.6.5
Severity Score:
Medium
CVE:
2025-39460
The vulnerability has been patched, so you should update to version 5.6.5.

Foton

Theme:
Foton
Theme Slug:
foton
Vulnerability:
Local File Inclusion
Patched in Version:
2.6.1
Severity Score:
High
CVE:
2025-39458
The vulnerability has been patched, so you should update to version 2.6.1.

Ivy School

Theme:
Ivy School
Theme Slug:
ivy-school
Vulnerability:
Local File Inclusion
Patched in Version:
1.6.1
Severity Score:
High
CVE:
2025-39470
The vulnerability has been patched, so you should update to version 1.6.1.

Real Estate 7

Theme:
Real Estate 7
Theme Slug:
realestate-7
Vulnerability:
Privilege Escalation
Patched in Version:
3.5.3
Severity Score:
High
CVE:
2025-39459
The vulnerability has been patched, so you should update to version 3.5.3.

Tastyc

Theme:
Tastyc
Theme Slug:
tastyc
Vulnerability:
Local File Inclusion
Patched in Version:
2.5.2
Severity Score:
High
CVE:
2025-27010
The vulnerability has been patched, so you should update to version 2.5.2.

Wanderland

Theme:
Wanderland
Theme Slug:
wanderland
Vulnerability:
Local File Inclusion
Patched in Version:
1.7.2
Severity Score:
High
CVE:
2025-39467
The vulnerability has been patched, so you should update to version 1.7.2.

Solid Security is part of Solid Suite — The best foundation for WordPress websites.

Every WordPress site needs security, backups, and management tools. That’s Solid Suite — an integrated bundle of three plugins: Solid Security, Solid Backups, and Solid Central. You also get access to Solid Academy’s learning resources for WordPress professionals. Build your next WordPress website on a solid foundation with Solid Suite!

Get Solid Security

Author:

Avatar photoSarah Ulmer

Sarah has been with SolidWP since 2015. Thanks to her deep connection to the brand, its products, and its users, Sarah was tapped as Solid’s primary Product Marketer in 2023. Sarah helps ensure that Solid’s product development team understands our users’ needs. When not at work, Sarah can be found at home with her husband, their three boys, and their dogs. Sarah enjoys long family walks, running with her lab, and watching her three boys play soccer. Sarah is originally from Texas and loves watching football games (Go Longhorns!)

Browse all of Sarah's articles

Author:

Avatar photoSarah Ulmer

Sarah has been with SolidWP since 2015. Thanks to her deep connection to the brand, its products, and its users, Sarah was tapped as Solid’s primary Product Marketer in 2023. Sarah helps ensure that Solid’s product development team understands our users’ needs. When not at work, Sarah can be found at home with her husband, their three boys, and their dogs. Sarah enjoys long family walks, running with her lab, and watching her three boys play soccer. Sarah is originally from Texas and loves watching football games (Go Longhorns!)

Browse all of Sarah's articles