WordPress Vulnerability Report

WordPress Vulnerability Report — June 11, 2025

Since last week, 306 new vulnerabilities emerged in the WordPress ecosystem, including 271 plugins and 35 themes. 172 of the vulnerable plugins and themes remain unpatched, but Solid Security Pro users are protected by virtual patching from Patchstack.

Avatar photo
Sarah Ulmer

Published:Jun 11, 2025

Filed Under:WordPress Vulnerability Report

Reading Time:54 min.

In this report, 306 vulnerabilities have been publicly disclosed. Security patches for 134 of these plugins and themes are available now, so run those updates as soon as possible. If you’re a Solid Security Pro user, the version management tool may have already warned you and updated these plugins, depending on your settings.

Additionally, there are 172 plugin and theme vulnerabilities, and no patch has been available yet. If you’re a Solid Security Pro user, those vulnerabilities are already protected by the Solid Security firewall. Virtual patches from Patchstack will be applied when a vulnerability is considered high or medium risk. If no patch is forthcoming from the vendor or the vulnerable software has been marked “closed” and dropped from the official WordPress repositories, you should deactivate it soon and look for alternative solutions.

Along with poor user account security, vulnerable plugins and themes are among the top reasons why WordPress websites get hacked. Unfortunately, cyberattacks are increasing in volume and sophistication. They’re also increasingly aimed at small to mid-sized businesses.

Our WordPress Vulnerability Report covers the latest emerging WordPress plugin, theme, and core vulnerabilities. Each vulnerability will have a severity rating of Low, Medium, High, or Critical. Responsible disclosure of vulnerabilities is essential to keeping the WordPress community safe. Please share this report to help spread the word and make WordPress — and the web — more secure.

WordPress Core

WordPress 6.8.1 was released on April 30, 2025. This maintenance release includes fixes for 15 bugs throughout Core and the Block Editor, addressing issues affecting multiple areas of WordPress, including the block editor, multisite, and REST API. For a full list, refer to the release candidate announcement.

No new core vulnerabilities were disclosed this week.

WordPress Plugins — 120 Patched / 151 Unpatched

Widget Logic

Plugin:
Widget Logic
Plugin Slug:
widget-logic
Installations
100,000+
Vulnerability:
Remote Code Execution (RCE)
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2025-32222
The vulnerability has not been patched. You should deactivate the plugin.

CubeWP – All-in-One Dynamic Content Framework

Plugin:
CubeWP – All-in-One Dynamic Content Framework
Plugin Slug:
cubewp-framework
Installations
5,000+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-30994
The vulnerability has not been patched. You should deactivate the plugin.

PayU CommercePro Plugin

Plugin:
PayU CommercePro Plugin
Plugin Slug:
payu-india
Installations
5,000+
Vulnerability:
Broken Authentication
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2025-31022
The vulnerability has not been patched. You should deactivate the plugin.

WP Shopify

Plugin:
WP Shopify
Plugin Slug:
wp-shopify
Installations
4,000+
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-30999
The vulnerability has not been patched. You should deactivate the plugin.

Easy Mega Menu Plugin for WordPress – ThemeHunk

Plugin:
Easy Mega Menu Plugin for WordPress – ThemeHunk
Plugin Slug:
themehunk-megamenu-plus
Installations
3,000+
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-30990
The vulnerability has not been patched. You should deactivate the plugin.

Widgetize Pages Light

Plugin:
Widgetize Pages Light
Plugin Slug:
widgetize-pages-light
Installations
3,000+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-30995
The vulnerability has not been patched. You should deactivate the plugin.

Premium Packages – Sell Digital Products Securely

Plugin:
Premium Packages – Sell Digital Products Securely
Plugin Slug:
wpdm-premium-packages
Installations
3,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-30991
The vulnerability has not been patched. You should deactivate the plugin.

Category Icon

Plugin:
Category Icon
Plugin Slug:
category-icon
Installations
2,000+
Vulnerability:
XML External Entity (XXE)
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2025-31039
The vulnerability has not been patched. You should deactivate the plugin.

Post Grid Master – Custom Post Types, Taxonomies & Ajax Filter Everything with Infinite Scroll, Load More, Pagination & Shortcode Builder

Plugin:
Post Grid Master – Custom Post Types, Taxonomies & Ajax Filter Everything with Infinite Scroll, Load More, Pagination & Shortcode Builder
Plugin Slug:
ajax-filter-posts
Installations
1,000+
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-30974
The vulnerability has not been patched. You should deactivate the plugin.

Booqable Rental Plugin

Plugin:
Booqable Rental Plugin
Plugin Slug:
booqable-rental-reservations
Installations
1,000+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-30956
The vulnerability has not been patched. You should deactivate the plugin.

Activity Plus Reloaded for BuddyPress

Plugin:
Activity Plus Reloaded for BuddyPress
Plugin Slug:
bp-activity-plus-reloaded
Installations
1,000+
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-30957
The vulnerability has not been patched. You should deactivate the plugin.

onOffice for WP-Websites

Plugin:
onOffice for WP-Websites
Plugin Slug:
onoffice-for-wp-websites
Installations
1,000+
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-30958
The vulnerability has not been patched. You should deactivate the plugin.

Simple Keyword to Link

Plugin:
Simple Keyword to Link
Plugin Slug:
simple-keyword-to-link
Installations
1,000+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-30980
The vulnerability has not been patched. You should deactivate the plugin.

All Currencies for WooCommerce

Plugin:
All Currencies for WooCommerce
Plugin Slug:
woocommerce-all-currencies
Installations
1,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-30950
The vulnerability has not been patched. You should deactivate the plugin.

WP Compress for MainWP

Plugin:
WP Compress for MainWP
Plugin Slug:
wp-compress-mainwp
Installations
900+
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-30932
The vulnerability has not been patched. You should deactivate the plugin.

???????????????

Plugin:
???????????????
Plugin Slug:
os-diagnosis-generator
Installations
800+
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-30934
The vulnerability has not been patched. You should deactivate the plugin.

Spice Blocks

Plugin:
Spice Blocks
Plugin Slug:
spice-blocks
Installations
800+
Vulnerability:
Arbitrary File Download
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-48130
The vulnerability has not been patched. You should deactivate the plugin.

ACF: Yandex Maps Field

Plugin:
ACF: Yandex Maps Field
Plugin Slug:
acf-yandex-maps-field
Installations
700+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-30930
The vulnerability has not been patched. You should deactivate the plugin.

Broadly for WordPress

Plugin:
Broadly for WordPress
Plugin Slug:
broadly
Installations
700+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-30938
The vulnerability has not been patched. You should deactivate the plugin.

Bitly URL Shortener

Plugin:
Bitly URL Shortener
Plugin Slug:
codehaveli-bitly-url-shortener
Installations
700+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-30629
The vulnerability has not been patched. You should deactivate the plugin.

«?????????» ?? DaData.ru

Plugin:
«?????????» ?? DaData.ru
Plugin Slug:
dadata-ru
Installations
700+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-30931
The vulnerability has not been patched. You should deactivate the plugin.

IFrame Widget

Plugin:
IFrame Widget
Plugin Slug:
iframe-widget
Installations
700+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-30939
The vulnerability has not been patched. You should deactivate the plugin.

Melipayamak

Plugin:
Melipayamak
Plugin Slug:
melipayamak
Installations
700+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-30940
The vulnerability has not been patched. You should deactivate the plugin.

Accessibility Suite by Ability, Inc

Plugin:
Accessibility Suite by Ability, Inc
Plugin Slug:
online-accessibility
Installations
700+
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-30636
The vulnerability has not been patched. You should deactivate the plugin.

Pinterest Verify Meta Tag

Plugin:
Pinterest Verify Meta Tag
Plugin Slug:
pinterest-verify-meta-tag
Installations
700+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-30941
The vulnerability has not been patched. You should deactivate the plugin.

Responsify WP

Plugin:
Responsify WP
Plugin Slug:
responsify-wp
Installations
700+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-30937
The vulnerability has not been patched. You should deactivate the plugin.

Wordapp

Plugin:
Wordapp
Plugin Slug:
wordapp
Installations
700+
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-30927
The vulnerability has not been patched. You should deactivate the plugin.

Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light

Plugin:
Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light
Plugin Slug:
excel-like-price-change-for-woocommerce-and-wp-e-commerce-light
Installations
600+
Vulnerability:
SQL Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2025-48122
The vulnerability has not been patched. You should deactivate the plugin.

WordLift – AI powered SEO – Schema

Plugin:
WordLift – AI powered SEO – Schema
Plugin Slug:
wordlift
Installations
600+
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-30624
The vulnerability has not been patched. You should deactivate the plugin.

Behance Portfolio Manager

Plugin:
Behance Portfolio Manager
Plugin Slug:
portfolio-manager-powered-by-behance
Installations
500+
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-29010
The vulnerability has not been patched. You should deactivate the plugin.

Wishlist

Plugin:
Wishlist
Plugin Slug:
wishlist
Installations
500+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-31061
The vulnerability has not been patched. You should deactivate the plugin.

HR Management Lite

Plugin:
HR Management Lite
Plugin Slug:
hr-management-lite
Installations
400+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-29005
The vulnerability has not been patched. You should deactivate the plugin.

Multi CryptoCurrency Payments

Plugin:
Multi CryptoCurrency Payments
Plugin Slug:
multi-crypto-currency-payment
Installations
400+
Vulnerability:
SQL Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2025-48141
The vulnerability has not been patched. You should deactivate the plugin.

WP AutoKeyword

Plugin:
WP AutoKeyword
Plugin Slug:
wp-autokeyword
Installations
400+
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-28997
The vulnerability has not been patched. You should deactivate the plugin.

GPP Slideshow

Plugin:
GPP Slideshow
Plugin Slug:
gpp-slideshow
Installations
300+
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-28996
The vulnerability has not been patched. You should deactivate the plugin.

Viral Loops WP Integration

Plugin:
Viral Loops WP Integration
Plugin Slug:
viral-loops-wp-integration
Installations
300+
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-28994
The vulnerability has not been patched. You should deactivate the plugin.

Viral Loops WP Integration

Plugin:
Viral Loops WP Integration
Plugin Slug:
viral-loops-wp-integration
Installations
300+
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-28995
The vulnerability has not been patched. You should deactivate the plugin.

Elastic Email Subscribe Form

Plugin:
Elastic Email Subscribe Form
Plugin Slug:
elastic-email-subscribe-form
Installations
200+
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-28985
The vulnerability has not been patched. You should deactivate the plugin.

Epicwin Plugin

Plugin:
Epicwin Plugin
Plugin Slug:
epicwin-subscribers
Installations
200+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-28986
The vulnerability has not been patched. You should deactivate the plugin.

Read More Login

Plugin:
Read More Login
Plugin Slug:
read-more-login
Installations
200+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-28989
The vulnerability has not been patched. You should deactivate the plugin.

Subscription Renewal Reminders for WooCommerce

Plugin:
Subscription Renewal Reminders for WooCommerce
Plugin Slug:
subscriptions-renewal-reminders
Installations
200+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-28984
The vulnerability has not been patched. You should deactivate the plugin.

Pay with Contact Form 7

Plugin:
Pay with Contact Form 7
Plugin Slug:
pay-with-contact-form-7
Installations
100+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-24772
The vulnerability has not been patched. You should deactivate the plugin.

Quick Event Calendar

Plugin:
Quick Event Calendar
Plugin Slug:
quick-event-calendar
Installations
100+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-27360
The vulnerability has not been patched. You should deactivate the plugin.

Recover abandoned cart for WooCommerce

Plugin:
Recover abandoned cart for WooCommerce
Plugin Slug:
recover-wc-abandoned-cart
Installations
100+
Vulnerability:
SQL Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2025-47608
The vulnerability has not been patched. You should deactivate the plugin.

WP Media File Type Manager

Plugin:
WP Media File Type Manager
Plugin Slug:
wp-media-file-type-manager
Installations
100+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-27359
The vulnerability has not been patched. You should deactivate the plugin.

TicketBAI Facturas para WooCommerce

Plugin:
TicketBAI Facturas para WooCommerce
Plugin Slug:
wp-ticketbai
Installations
80+
Vulnerability:
SQL Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2025-24767
The vulnerability has not been patched. You should deactivate the plugin.

TicketBAI Facturas para WooCommerce

Plugin:
TicketBAI Facturas para WooCommerce
Plugin Slug:
wp-ticketbai
Installations
80+
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-24762
The vulnerability has not been patched. You should deactivate the plugin.

One-Login

Plugin:
One-Login
Plugin Slug:
one-login
Installations
70+
Vulnerability:
Privilege Escalation
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-23974
The vulnerability has not been patched. You should deactivate the plugin.

Next Event Calendar

Plugin:
Next Event Calendar
Plugin Slug:
next-event-calendar
Installations
60+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2023-26001
The vulnerability has not been patched. You should deactivate the plugin.

WP Post Corrector

Plugin:
WP Post Corrector
Plugin Slug:
wp-post-corrector
Installations
60+
Vulnerability:
SQL Injection
Patched in Version:
No Fix
Severity Score:
High
CVE:
2023-26003
The vulnerability has not been patched. You should deactivate the plugin.

6Storage Rentals

Plugin:
6Storage Rentals
Plugin Slug:
6storage-rentals
Installations
50+
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2023-26002
The vulnerability has not been patched. You should deactivate the plugin.

Bang tinh vay

Plugin:
Bang tinh vay
Plugin Slug:
bang-tinh-lai-suat
Installations
50+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2023-26000
The vulnerability has not been patched. You should deactivate the plugin.

Sola Support Tickets

Plugin:
Sola Support Tickets
Plugin Slug:
sola-support-tickets
Installations
50+
Vulnerability:
Arbitrary Content Deletion
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2023-25997
The vulnerability has not been patched. You should deactivate the plugin.

Interactive Regional Map of Africa

Plugin:
Interactive Regional Map of Africa
Plugin Slug:
interactive-map-of-africa
Installations
30+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-49449
The vulnerability has not been patched. You should deactivate the plugin.

SEPA Girocode

Plugin:
SEPA Girocode
Plugin Slug:
sepa-girocode
Installations
30+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-49450
The vulnerability has not been patched. You should deactivate the plugin.

Admin Notes

Plugin:
Admin Notes
Plugin Slug:
admin-note
Installations
20+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-49446
The vulnerability has not been patched. You should deactivate the plugin.

Interactive UK Regional Map

Plugin:
Interactive UK Regional Map
Plugin Slug:
interactive-uk-regional-map
Installations
20+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-49445
The vulnerability has not been patched. You should deactivate the plugin.

Bacon Ipsum

Plugin:
Bacon Ipsum
Plugin Slug:
bacon-ipsum
Installations
10+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-49443
The vulnerability has not been patched. You should deactivate the plugin.

Interactive Regional Map of Florida

Plugin:
Interactive Regional Map of Florida
Plugin Slug:
interactive-map-of-florida
Installations
10+
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-49441
The vulnerability has not been patched. You should deactivate the plugin.

Team Builder

Plugin:
Team Builder
Plugin Slug:
a-team-showcase
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-32308
The vulnerability has not been patched. You should deactivate the plugin.

Abbie Expander

Plugin:
Abbie Expander
Plugin Slug:
abbie-expander
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-49427
The vulnerability has not been patched. You should deactivate the plugin.

Advanced Post List

Plugin:
Advanced Post List
Plugin Slug:
advanced-post-list
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-30968
The vulnerability has not been patched. You should deactivate the plugin.

AI Mortgage Calculator

Plugin:
AI Mortgage Calculator
Plugin Slug:
ai-mortgage-calculator
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2023-25995
The vulnerability has not been patched. You should deactivate the plugin.

AppBanners

Plugin:
AppBanners
Plugin Slug:
appbanners
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-30625
The vulnerability has not been patched. You should deactivate the plugin.

Atelier Create CV

Plugin:
Atelier Create CV
Plugin Slug:
atelier-create-cv
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-49439
The vulnerability has not been patched. You should deactivate the plugin.

Backwp

Plugin:
Backwp
Plugin Slug:
backwp
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-28954
The vulnerability has not been patched. You should deactivate the plugin.

bbPress API

Plugin:
bbPress API
Plugin Slug:
bbp-api
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-24763
The vulnerability has not been patched. You should deactivate the plugin.

Bg Orthodox Calendar

Plugin:
Bg Orthodox Calendar
Plugin Slug:
bg-orthodox-calendar
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-28958
The vulnerability has not been patched. You should deactivate the plugin.

BNS Featured Category

Plugin:
BNS Featured Category
Plugin Slug:
bns-featured-category
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-5538
The vulnerability has not been patched. You should deactivate the plugin.

BP Profile as Homepage

Plugin:
BP Profile as Homepage
Plugin Slug:
bp-profile-as-homepage
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-49453
The vulnerability has not been patched. You should deactivate the plugin.

Bunny’s Print CSS

Plugin:
Bunny’s Print CSS
Plugin Slug:
bunnys-print-css
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-5925
The vulnerability has not been patched. You should deactivate the plugin.

WPCHURCH

Plugin:
WPCHURCH
Plugin Slug:
church-management
Vulnerability:
SQL Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2025-32303
The vulnerability has not been patched. You should deactivate the plugin.

HyperComments

Plugin:
HyperComments
Plugin Slug:
comments-with-hypercommentscom
Vulnerability:
Privilege Escalation
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2025-5701
The vulnerability has not been patched. You should deactivate the plugin.

Complete Google Seo Scan

Plugin:
Complete Google Seo Scan
Plugin Slug:
complete-google-seo-scan
Vulnerability:
SQL Injection
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-26590
The vulnerability has not been patched. You should deactivate the plugin.

Contact Form

Plugin:
Contact Form
Plugin Slug:
contact-form-ready
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-30935
The vulnerability has not been patched. You should deactivate the plugin.

WordPress Ajax Load More and Infinite Scroll

Plugin:
WordPress Ajax Load More and Infinite Scroll
Plugin Slug:
cpt-ajax-load-more
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-5586
The vulnerability has not been patched. You should deactivate the plugin.

CubePoints

Plugin:
CubePoints
Plugin Slug:
cubepoints
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-28952
The vulnerability has not been patched. You should deactivate the plugin.

Custom Bulk/Quick Edit

Plugin:
Custom Bulk/Quick Edit
Plugin Slug:
custom-bulkquick-edit
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-30946
The vulnerability has not been patched. You should deactivate the plugin.

Custom Category/Post Type Post order

Plugin:
Custom Category/Post Type Post order
Plugin Slug:
custom-post-order-category
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-29013
The vulnerability has not been patched. You should deactivate the plugin.

Developer Formatter

Plugin:
Developer Formatter
Plugin Slug:
devformatter
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-5699
The vulnerability has not been patched. You should deactivate the plugin.

Slack Notifications by dorzki

Plugin:
Slack Notifications by dorzki
Plugin Slug:
dorzki-notifications-to-slack
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-30978
The vulnerability has not been patched. You should deactivate the plugin.

ZoomSounds

Plugin:
ZoomSounds
Plugin Slug:
dzs-zoomsounds
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-47566
The vulnerability has not been patched. You should deactivate the plugin.

Elegant Visitor Counter

Plugin:
Elegant Visitor Counter
Plugin Slug:
elegant-visitor-counter
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-30627
The vulnerability has not been patched. You should deactivate the plugin.

Universal Video Player

Plugin:
Universal Video Player
Plugin Slug:
elementor_widget_universal_video_player
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-31057
The vulnerability has not been patched. You should deactivate the plugin.

elfsight Contact Form widget

Plugin:
elfsight Contact Form widget
Plugin Slug:
elfsight-contact-form
Vulnerability:
Sensitive Data Exposure
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-31045
The vulnerability has not been patched. You should deactivate the plugin.

Elite Video Player

Plugin:
Elite Video Player
Plugin Slug:
elite-video-player
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-30986
The vulnerability has not been patched. You should deactivate the plugin.

Foxit eSign for WordPress

Plugin:
Foxit eSign for WordPress
Plugin Slug:
esign-genie-for-wp
Vulnerability:
Other Vulnerability Type
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-49419
The vulnerability has not been patched. You should deactivate the plugin.

ESV Bible Shortcode for WordPress

Plugin:
ESV Bible Shortcode for WordPress
Plugin Slug:
esv-bible-shortcode-for-wordpress
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-5534
The vulnerability has not been patched. You should deactivate the plugin.

FastBook

Plugin:
FastBook
Plugin Slug:
fastbook-responsive-appointment-booking-and-scheduling-system
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-26593
The vulnerability has not been patched. You should deactivate the plugin.

File Provider

Plugin:
File Provider
Plugin Slug:
file-provider
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-4580
The vulnerability has not been patched. You should deactivate the plugin.

File Provider

Plugin:
File Provider
Plugin Slug:
file-provider
Vulnerability:
SQL Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2025-4578
The vulnerability has not been patched. You should deactivate the plugin.

Free WP Mail SMTP

Plugin:
Free WP Mail SMTP
Plugin Slug:
free-wp-mail-smtp
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-28974
The vulnerability has not been patched. You should deactivate the plugin.

Global Translator

Plugin:
Global Translator
Plugin Slug:
global-translator
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-30630
The vulnerability has not been patched. You should deactivate the plugin.

Global Translator

Plugin:
Global Translator
Plugin Slug:
global-translator
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-30632
The vulnerability has not been patched. You should deactivate the plugin.

Hide It

Plugin:
Hide It
Plugin Slug:
hide-it
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-5565
The vulnerability has not been patched. You should deactivate the plugin.

Hive Support

Plugin:
Hive Support
Plugin Slug:
hive-support
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-5018
The vulnerability has not been patched. You should deactivate the plugin.

Hive Support

Plugin:
Hive Support
Plugin Slug:
hive-support
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-5019
The vulnerability has not been patched. You should deactivate the plugin.

Image Hover Effects Block

Plugin:
Image Hover Effects Block
Plugin Slug:
image-hover-effects-block
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-31025
The vulnerability has not been patched. You should deactivate the plugin.

InWave Jobs

Plugin:
InWave Jobs
Plugin Slug:
iwjob
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2025-39477
The vulnerability has not been patched. You should deactivate the plugin.

KI Live Video Conferences

Plugin:
KI Live Video Conferences
Plugin Slug:
ki-live-video-conferences
Vulnerability:
Sensitive Data Exposure
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-23969
The vulnerability has not been patched. You should deactivate the plugin.

KI Live Video Conferences

Plugin:
KI Live Video Conferences
Plugin Slug:
ki-live-video-conferences
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-23971
The vulnerability has not been patched. You should deactivate the plugin.

Konami Easter Egg

Plugin:
Konami Easter Egg
Plugin Slug:
konami-easter-egg
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-49425
The vulnerability has not been patched. You should deactivate the plugin.

Layouts for Elementor

Plugin:
Layouts for Elementor
Plugin Slug:
layouts-for-elementor
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-30948
The vulnerability has not been patched. You should deactivate the plugin.

CLEVER

Plugin:
CLEVER
Plugin Slug:
lbg-audio11-html5-shoutcast_history
Vulnerability:
Arbitrary File Download
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-31635
The vulnerability has not been patched. You should deactivate the plugin.

Sticky Radio Player

Plugin:
Sticky Radio Player
Plugin Slug:
lbg-audio5-html5-shoutcast_sticky
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-31426
The vulnerability has not been patched. You should deactivate the plugin.

SHOUT

Plugin:
SHOUT
Plugin Slug:
lbg-audio8-html5-radio_ads
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-31925
The vulnerability has not been patched. You should deactivate the plugin.

WP Lead Capturing Pages

Plugin:
WP Lead Capturing Pages
Plugin Slug:
leadcapture
Vulnerability:
SQL Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2025-31424
The vulnerability has not been patched. You should deactivate the plugin.

MapSVG

Plugin:
MapSVG
Plugin Slug:
mapsvg
Vulnerability:
Privilege Escalation
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-47561
The vulnerability has not been patched. You should deactivate the plugin.

Mediabay – WordPress Media Library Folders

Plugin:
Mediabay – WordPress Media Library Folders
Plugin Slug:
mediabay
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-28948
The vulnerability has not been patched. You should deactivate the plugin.

No Spam At All

Plugin:
No Spam At All
Plugin Slug:
no-spam-at-all
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-24778
The vulnerability has not been patched. You should deactivate the plugin.

Paged Gallery

Plugin:
Paged Gallery
Plugin Slug:
paged-gallery
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-5686
The vulnerability has not been patched. You should deactivate the plugin.

Payment QR WooCommerce

Plugin:
Payment QR WooCommerce
Plugin Slug:
payment-qr-woo
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-31000
The vulnerability has not been patched. You should deactivate the plugin.

Personal Favicon

Plugin:
Personal Favicon
Plugin Slug:
personal-favicon
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-28964
The vulnerability has not been patched. You should deactivate the plugin.

Post Author

Plugin:
Post Author
Plugin Slug:
post-author
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-28950
The vulnerability has not been patched. You should deactivate the plugin.

Post Custom Templates Lite

Plugin:
Post Custom Templates Lite
Plugin Slug:
post-custom-templates-lite
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-30942
The vulnerability has not been patched. You should deactivate the plugin.

Powie’s Uptime Robot

Plugin:
Powie’s Uptime Robot
Plugin Slug:
powies-uptime-robot
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-30638
The vulnerability has not been patched. You should deactivate the plugin.

Recent Posts Slider Responsive

Plugin:
Recent Posts Slider Responsive
Plugin Slug:
recent-posts-slider-responsive
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-28966
The vulnerability has not been patched. You should deactivate the plugin.

Responsive Flipbooks

Plugin:
Responsive Flipbooks
Plugin Slug:
responsive-flipbooks
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-24776
The vulnerability has not been patched. You should deactivate the plugin.

Revolution Video Player

Plugin:
Revolution Video Player
Plugin Slug:
revolution_video_player
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-31058
The vulnerability has not been patched. You should deactivate the plugin.

Runners Log

Plugin:
Runners Log
Plugin Slug:
runners-log
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-5541
The vulnerability has not been patched. You should deactivate the plugin.

Seofy Core

Plugin:
Seofy Core
Plugin Slug:
seofy-core
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-39473
The vulnerability has not been patched. You should deactivate the plugin.

Simple Google Static Map

Plugin:
Simple Google Static Map
Plugin Slug:
simple-google-static-map
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-27334
The vulnerability has not been patched. You should deactivate the plugin.

Simple Nested Menu

Plugin:
Simple Nested Menu
Plugin Slug:
simple-nested-menu
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-49442
The vulnerability has not been patched. You should deactivate the plugin.

SocialMark

Plugin:
SocialMark
Plugin Slug:
socialmark
Vulnerability:
Server Side Request Forgery (SSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-29008
The vulnerability has not been patched. You should deactivate the plugin.

StageShow

Plugin:
StageShow
Plugin Slug:
stageshow
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-5703
The vulnerability has not been patched. You should deactivate the plugin.

Motors – Events

Plugin:
Motors – Events
Plugin Slug:
stm-motors-events
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2025-47586
The vulnerability has not been patched. You should deactivate the plugin.

Stop Spammers

Plugin:
Stop Spammers
Plugin Slug:
stop-spammer-registrations-plugin
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-2935
The vulnerability has not been patched. You should deactivate the plugin.

The Holiday Calendar

Plugin:
The Holiday Calendar
Plugin Slug:
the-holiday-calendar
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-29003
The vulnerability has not been patched. You should deactivate the plugin.

Universal Video Player

Plugin:
Universal Video Player
Plugin Slug:
universal_video_player
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-31917
The vulnerability has not been patched. You should deactivate the plugin.

Video Embeds

Plugin:
Video Embeds
Plugin Slug:
video-embeds
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-49429
The vulnerability has not been patched. You should deactivate the plugin.

Direct Checkout for WooCommerce Lite

Plugin:
Direct Checkout for WooCommerce Lite
Plugin Slug:
woo-direct-checkout-lite
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-29006
The vulnerability has not been patched. You should deactivate the plugin.

WooCommerce Photo Reviews – Review Reminders – Review for Discounts

Plugin:
WooCommerce Photo Reviews – Review Reminders – Review for Discounts
Plugin Slug:
woocommerce-photo-reviews
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-47570
The vulnerability has not been patched. You should deactivate the plugin.

WooCommerce Ultimate Gift Card – Create, Sell and Manage Gift Cards with Customized Email Templates

Plugin:
WooCommerce Ultimate Gift Card – Create, Sell and Manage Gift Cards with Customized Email Templates
Plugin Slug:
woocommerce-ultimate-gift-card
Vulnerability:
SQL Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2025-47569
The vulnerability has not been patched. You should deactivate the plugin.

WooBeWoo Product Filter Pro

Plugin:
WooBeWoo Product Filter Pro
Plugin Slug:
woofilter-pro
Vulnerability:
SQL Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2025-39496
The vulnerability has not been patched. You should deactivate the plugin.

Wp Easy Allopass

Plugin:
Wp Easy Allopass
Plugin Slug:
wordpress-easy-allopass
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-49435
The vulnerability has not been patched. You should deactivate the plugin.

WP-Addpub

Plugin:
WP-Addpub
Plugin Slug:
wp-addpub
Vulnerability:
SQL Injection
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-5563
The vulnerability has not been patched. You should deactivate the plugin.

WP Biographia

Plugin:
WP Biographia
Plugin Slug:
wp-biographia
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-30928
The vulnerability has not been patched. You should deactivate the plugin.

WP Email Debug

Plugin:
WP Email Debug
Plugin Slug:
wp-email-debug
Vulnerability:
Privilege Escalation
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2025-5486
The vulnerability has not been patched. You should deactivate the plugin.

WP Featured Content Slider

Plugin:
WP Featured Content Slider
Plugin Slug:
wp-featured-content-slider
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-30634
The vulnerability has not been patched. You should deactivate the plugin.

Freemind Viewer

Plugin:
Freemind Viewer
Plugin Slug:
wp-freemind
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-5536
The vulnerability has not been patched. You should deactivate the plugin.

WP Mail Options

Plugin:
WP Mail Options
Plugin Slug:
wp-mail-options
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-28981
The vulnerability has not been patched. You should deactivate the plugin.

WP Online Users Stats

Plugin:
WP Online Users Stats
Plugin Slug:
wp-online-users-stats
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-4966
The vulnerability has not been patched. You should deactivate the plugin.

WP-Recall

Plugin:
WP-Recall
Plugin Slug:
wp-recall
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-30981
The vulnerability has not been patched. You should deactivate the plugin.

WP Security Master

Plugin:
WP Security Master
Plugin Slug:
wp-security-master
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-49440
The vulnerability has not been patched. You should deactivate the plugin.

WP Text Expander

Plugin:
WP Text Expander
Plugin Slug:
wp-text-expander
Vulnerability:
SQL Injection
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-49421
The vulnerability has not been patched. You should deactivate the plugin.

YouTube Simple Gallery

Plugin:
YouTube Simple Gallery
Plugin Slug:
youtube-simple-gallery
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-29011
The vulnerability has not been patched. You should deactivate the plugin.

Broken Link Checker

Plugin:
Broken Link Checker
Plugin Slug:
broken-link-checker
Installations
600,000+
Vulnerability:
Sensitive Data Exposure
Patched in Version:
2.4.5
Severity Score:
Medium
CVE:
2025-4047
The vulnerability has been patched, so you should update to version 2.4.5.

Ocean Extra

Plugin:
Ocean Extra
Plugin Slug:
ocean-extra
Installations
600,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.4.9
Severity Score:
Medium
CVE:
2025-49068
The vulnerability has been patched, so you should update to version 2.4.9.

WP Shortcodes Plugin — Shortcodes Ultimate

Plugin:
WP Shortcodes Plugin — Shortcodes Ultimate
Plugin Slug:
shortcodes-ultimate
Installations
500,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
7.4.0
Severity Score:
Medium
CVE:
2025-49244
The vulnerability has been patched, so you should update to version 7.4.0.

Simple History – Track, Log, and Audit WordPress Changes

Plugin:
Simple History – Track, Log, and Audit WordPress Changes
Plugin Slug:
simple-history
Installations
300,000+
Vulnerability:
Sensitive Data Exposure
Patched in Version:
5.8.2
Severity Score:
Medium
CVE:
2025-5760
The vulnerability has been patched, so you should update to version 5.8.2.

Real Cookie Banner: GDPR & ePrivacy Cookie Consent

Plugin:
Real Cookie Banner: GDPR & ePrivacy Cookie Consent
Plugin Slug:
real-cookie-banner
Installations
100,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
5.1.6
Severity Score:
Medium
CVE:
2025-1485
The vulnerability has been patched, so you should update to version 5.1.6.

Social Sharing Plugin – Sassy Social Share

Plugin:
Social Sharing Plugin – Sassy Social Share
Plugin Slug:
sassy-social-share
Installations
100,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.3.76
Severity Score:
High
CVE:
2025-5528
The vulnerability has been patched, so you should update to version 3.3.76.

Ninja Tables – Easy Data Table Builder

Plugin:
Ninja Tables – Easy Data Table Builder
Plugin Slug:
ninja-tables
Installations
80,000+
Vulnerability:
PHP Object Injection
Patched in Version:
5.0.19
Severity Score:
Critical
CVE:
2025-2939
The vulnerability has been patched, so you should update to version 5.0.19.

WP Table Builder – WordPress Table Plugin

Plugin:
WP Table Builder – WordPress Table Plugin
Plugin Slug:
wp-table-builder
Installations
60,000+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
2.0.7
Severity Score:
Medium
CVE:
2025-49286
The vulnerability has been patched, so you should update to version 2.0.7.

WPtouch – Make your WordPress Website Mobile-Friendly

Plugin:
WPtouch – Make your WordPress Website Mobile-Friendly
Plugin Slug:
wptouch
Installations
60,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
4.3.61
Severity Score:
Medium
CVE:
2025-49318
The vulnerability has been patched, so you should update to version 4.3.61.

Calculated Fields Form

Plugin:
Calculated Fields Form
Plugin Slug:
calculated-fields-form
Installations
50,000+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
5.3.59
Severity Score:
Medium
CVE:
2025-49291
The vulnerability has been patched, so you should update to version 5.3.59.

Greenshift – animation and page builder blocks

Plugin:
Greenshift – animation and page builder blocks
Plugin Slug:
greenshift-animation-and-page-builder-blocks
Installations
50,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
11.5.7
Severity Score:
Medium
CVE:
2025-49301
The vulnerability has been patched, so you should update to version 11.5.7.

Sina Extension for Elementor (Header Builder, Footer Builter, Theme Builder, Slider, Gallery, Form, Modal, Data Table Free Elementor Widgets & Elementor Templates)

Plugin:
Sina Extension for Elementor (Header Builder, Footer Builter, Theme Builder, Slider, Gallery, Form, Modal, Data Table Free Elementor Widgets & Elementor Templates)
Plugin Slug:
sina-extension-for-elementor
Installations
50,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.7.0
Severity Score:
High
CVE:
2025-49262
The vulnerability has been patched, so you should update to version 3.7.0.

FancyBox for WordPress

Plugin:
FancyBox for WordPress
Plugin Slug:
fancybox-for-wordpress
Installations
40,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.3.6
Severity Score:
High
CVE:
2025-3662
The vulnerability has been patched, so you should update to version 3.3.6.

?????? ????? ??????? Persian WooCommerce SMS

Plugin:
?????? ????? ??????? Persian WooCommerce SMS
Plugin Slug:
persian-woocommerce-sms
Installations
40,000+
Vulnerability:
SQL Injection
Patched in Version:
7.1.0
Severity Score:
High
CVE:
2025-49315
The vulnerability has been patched, so you should update to version 7.1.0.

Simple Membership

Plugin:
Simple Membership
Plugin Slug:
simple-membership
Installations
40,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
4.6.4
Severity Score:
Medium
CVE:
2025-49333
The vulnerability has been patched, so you should update to version 4.6.4.

RTMKit Addons for Elementor

Plugin:
RTMKit Addons for Elementor
Plugin Slug:
rometheme-for-elementor
Installations
30,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.6.1
Severity Score:
Medium
CVE:
2025-49235
The vulnerability has been patched, so you should update to version 1.6.1.

Print Invoice & Delivery Notes for WooCommerce

Plugin:
Print Invoice & Delivery Notes for WooCommerce
Plugin Slug:
woocommerce-delivery-notes
Installations
30,000+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
5.6.0
Severity Score:
Medium
CVE:
2025-49239
The vulnerability has been patched, so you should update to version 5.6.0.

Welcart e-Commerce

Plugin:
Welcart e-Commerce
Plugin Slug:
usc-e-shop
Installations
20,000+
Vulnerability:
Arbitrary File Deletion
Patched in Version:
2.11.14
Severity Score:
Medium
CVE:
2025-47511
The vulnerability has been patched, so you should update to version 2.11.14.

Backup and Staging by WP Time Capsule

Plugin:
Backup and Staging by WP Time Capsule
Plugin Slug:
wp-time-capsule
Installations
20,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.22.24
Severity Score:
High
CVE:
2025-47477
The vulnerability has been patched, so you should update to version 1.22.24.

Store Locator WordPress

Plugin:
Store Locator WordPress
Plugin Slug:
agile-store-locator
Installations
10,000+
Vulnerability:
Arbitrary File Upload
Patched in Version:
1.5.3
Severity Score:
Medium
CVE:
2025-49329
The vulnerability has been patched, so you should update to version 1.5.3.

Store Locator WordPress

Plugin:
Store Locator WordPress
Plugin Slug:
agile-store-locator
Installations
10,000+
Vulnerability:
SQL Injection
Patched in Version:
1.5.2
Severity Score:
High
CVE:
2025-49328
The vulnerability has been patched, so you should update to version 1.5.2.

Bellows Accordion Menu

Plugin:
Bellows Accordion Menu
Plugin Slug:
bellows-accordion-menu
Installations
10,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.4.4
Severity Score:
Medium
CVE:
2025-49242
The vulnerability has been patched, so you should update to version 1.4.4.

Music Player for Elementor – Audio Player & Podcast Player

Plugin:
Music Player for Elementor – Audio Player & Podcast Player
Plugin Slug:
music-player-for-elementor
Installations
10,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.4.7
Severity Score:
Medium
CVE:
2025-5340
The vulnerability has been patched, so you should update to version 2.4.7.

ShiftNav – Responsive Mobile Menu

Plugin:
ShiftNav – Responsive Mobile Menu
Plugin Slug:
shiftnav-responsive-mobile-menu
Installations
10,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.8.1
Severity Score:
Medium
CVE:
2025-49243
The vulnerability has been patched, so you should update to version 1.8.1.

WP Multilang – Translation and Multilingual Plugin

Plugin:
WP Multilang – Translation and Multilingual Plugin
Plugin Slug:
wp-multilang
Installations
10,000+
Vulnerability:
Local File Inclusion
Patched in Version:
2.4.19.1
Severity Score:
High
CVE:
2025-49307
The vulnerability has been patched, so you should update to version 2.4.19.1.

Ultimate Gift Cards for WooCommerce

Plugin:
Ultimate Gift Cards for WooCommerce
Plugin Slug:
woo-gift-cards-lite
Installations
7,000+
Vulnerability:
SQL Injection
Patched in Version:
3.1.5
Severity Score:
High
CVE:
2025-5103
The vulnerability has been patched, so you should update to version 3.1.5.

Password Policy Manager | Password Manager

Plugin:
Password Policy Manager | Password Manager
Plugin Slug:
password-policy-manager
Installations
5,000+
Vulnerability:
Broken Authentication
Patched in Version:
2.0.5
Severity Score:
High
CVE:
2025-31019
The vulnerability has been patched, so you should update to version 2.0.5.

WP Social Widget

Plugin:
WP Social Widget
Plugin Slug:
wp-social-widget
Installations
5,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.3.1
Severity Score:
Medium
CVE:
2025-49306
The vulnerability has been patched, so you should update to version 2.3.1.

Min Max Step Quantity Limits Manager for WooCommerce

Plugin:
Min Max Step Quantity Limits Manager for WooCommerce
Plugin Slug:
product-quantity-for-woocommerce
Installations
4,000+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
5.1.1
Severity Score:
Medium
CVE:
2025-49510
The vulnerability has been patched, so you should update to version 5.1.1.

WordPress Comments Import & Export

Plugin:
WordPress Comments Import & Export
Plugin Slug:
comments-import-export-woocommerce
Installations
3,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.4.4
Severity Score:
Medium
CVE:
2025-3919
The vulnerability has been patched, so you should update to version 2.4.4.

The Events Calendar Countdown Addon

Plugin:
The Events Calendar Countdown Addon
Plugin Slug:
countdown-for-the-events-calendar
Installations
3,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.4.10
Severity Score:
Medium
CVE:
2025-49311
The vulnerability has been patched, so you should update to version 1.4.10.

Libro de Reclamaciones y Quejas

Plugin:
Libro de Reclamaciones y Quejas
Plugin Slug:
libro-de-reclamaciones-y-quejas
Installations
3,000+
Vulnerability:
SQL Injection
Patched in Version:
1.0
Severity Score:
High
CVE:
2025-30989
The vulnerability has been patched, so you should update to version 1.0.

Newsletters

Plugin:
Newsletters
Plugin Slug:
newsletters-lite
Installations
3,000+
Vulnerability:
Local File Inclusion
Patched in Version:
4.10
Severity Score:
High
CVE:
2025-4857
The vulnerability has been patched, so you should update to version 4.10.

WP Maintenance Mode & Site Under Construction

Plugin:
WP Maintenance Mode & Site Under Construction
Plugin Slug:
wp-maintenance-mode-site-under-construction
Installations
3,000+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
4.4
Severity Score:
Medium
CVE:
2025-49284
The vulnerability has been patched, so you should update to version 4.4.

BlockStrap Page Builder – Bootstrap Blocks

Plugin:
BlockStrap Page Builder – Bootstrap Blocks
Plugin Slug:
blockstrap-page-builder-blocks
Installations
2,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
0.1.37
Severity Score:
Medium
CVE:
2025-30951
The vulnerability has been patched, so you should update to version 0.1.37.

oik

Plugin:
oik
Plugin Slug:
oik
Installations
2,000+
Vulnerability:
Broken Access Control
Patched in Version:
4.15.2
Severity Score:
Medium
CVE:
2025-49241
The vulnerability has been patched, so you should update to version 4.15.2.

Event post

Plugin:
Event post
Plugin Slug:
event-post
Installations
1,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
5.10.2
Severity Score:
Medium
CVE:
2025-49298
The vulnerability has been patched, so you should update to version 5.10.2.

WP Gravity Forms Salesforce

Plugin:
WP Gravity Forms Salesforce
Plugin Slug:
gf-salesforce-crmperks
Installations
1,000+
Vulnerability:
Open Redirection
Patched in Version:
1.4.8
Severity Score:
Medium
CVE:
2025-30953
The vulnerability has been patched, so you should update to version 1.4.8.

Market Exporter

Plugin:
Market Exporter
Plugin Slug:
market-exporter
Installations
1,000+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
2.0.23
Severity Score:
Medium
CVE:
2025-49269
The vulnerability has been patched, so you should update to version 2.0.23.

Membership For WooCommerce

Plugin:
Membership For WooCommerce
Plugin Slug:
membership-for-woocommerce
Installations
1,000+
Vulnerability:
Broken Access Control
Patched in Version:
2.8.2
Severity Score:
High
CVE:
2025-49265
The vulnerability has been patched, so you should update to version 2.8.2.

Newspack Newsletters

Plugin:
Newspack Newsletters
Plugin Slug:
newspack-newsletters
Installations
1,000+
Vulnerability:
Open Redirection
Patched in Version:
3.14.0
Severity Score:
Medium
CVE:
2025-49325
The vulnerability has been patched, so you should update to version 3.14.0.

Product Catalog Simple

Plugin:
Product Catalog Simple
Plugin Slug:
post-type-x
Installations
1,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.8.2
Severity Score:
Medium
CVE:
2025-49305
The vulnerability has been patched, so you should update to version 1.8.2.

Raychat

Plugin:
Raychat
Plugin Slug:
raychat
Installations
1,000+
Vulnerability:
Broken Access Control
Patched in Version:
2.2.0
Severity Score:
Medium
CVE:
2025-49236
The vulnerability has been patched, so you should update to version 2.2.0.

Stock Locations for WooCommerce

Plugin:
Stock Locations for WooCommerce
Plugin Slug:
stock-locations-for-woocommerce
Installations
1,000+
Vulnerability:
Broken Access Control
Patched in Version:
2.8.7
Severity Score:
High
CVE:
2025-47463
The vulnerability has been patched, so you should update to version 2.8.7.

Vayu Blocks – Website Builder for the Block Editor

Plugin:
Vayu Blocks – Website Builder for the Block Editor
Plugin Slug:
vayu-blocks
Installations
1,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.3.2
Severity Score:
Medium
CVE:
2025-4420
The vulnerability has been patched, so you should update to version 1.3.2.

WordPress CRM Plugin – WP-CRM System

Plugin:
WordPress CRM Plugin – WP-CRM System
Plugin Slug:
wp-crm-system
Installations
1,000+
Vulnerability:
Broken Access Control
Patched in Version:
3.4.3
Severity Score:
Medium
CVE:
2025-49270
The vulnerability has been patched, so you should update to version 3.4.3.

WP Time Slots Booking Form

Plugin:
WP Time Slots Booking Form
Plugin Slug:
wp-time-slots-booking-form
Installations
1,000+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
1.2.31
Severity Score:
Medium
CVE:
2025-49332
The vulnerability has been patched, so you should update to version 1.2.31.

WordPress Contact Forms by Cimatti

Plugin:
WordPress Contact Forms by Cimatti
Plugin Slug:
contact-forms
Installations
900+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
1.9.9
Severity Score:
Medium
CVE:
2025-49069
The vulnerability has been patched, so you should update to version 1.9.9.

WP Gravity Forms Constant Contact Plugin

Plugin:
WP Gravity Forms Constant Contact Plugin
Plugin Slug:
gf-constant-contact
Installations
900+
Vulnerability:
Open Redirection
Patched in Version:
1.1.1
Severity Score:
Medium
CVE:
2025-30954
The vulnerability has been patched, so you should update to version 1.1.1.

PDF for WPForms + Drag and Drop Template Builder

Plugin:
PDF for WPForms + Drag and Drop Template Builder
Plugin Slug:
pdf-for-wpforms
Installations
900+
Vulnerability:
Broken Access Control
Patched in Version:
5.6.1
Severity Score:
Medium
CVE:
2025-49289
The vulnerability has been patched, so you should update to version 5.6.1.

Ultimate WP Mail

Plugin:
Ultimate WP Mail
Plugin Slug:
ultimate-wp-mail
Installations
900+
Vulnerability:
Broken Authentication
Patched in Version:
1.3.6
Severity Score:
High
CVE:
2025-49288
The vulnerability has been patched, so you should update to version 1.3.6.

FraudLabs Pro for WooCommerce

Plugin:
FraudLabs Pro for WooCommerce
Plugin Slug:
fraudlabs-pro-for-woocommerce
Installations
800+
Vulnerability:
Broken Access Control
Patched in Version:
2.22.12
Severity Score:
Medium
CVE:
2025-49320
The vulnerability has been patched, so you should update to version 2.22.12.

Booking Ultra Pro Appointments Booking Calendar Plugin

Plugin:
Booking Ultra Pro Appointments Booking Calendar Plugin
Plugin Slug:
booking-ultra-pro
Installations
700+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.1.21
Severity Score:
Medium
CVE:
2025-30637
The vulnerability has been patched, so you should update to version 1.1.21.

Broadstreet

Plugin:
Broadstreet
Plugin Slug:
broadstreet
Installations
700+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.51.8
Severity Score:
High
CVE:
2025-4652
The vulnerability has been patched, so you should update to version 1.51.8.

Frontend Dashboard

Plugin:
Frontend Dashboard
Plugin Slug:
frontend-dashboard
Installations
700+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.2.9
Severity Score:
Medium
CVE:
2025-49310
The vulnerability has been patched, so you should update to version 2.2.9.

WP Team – WordPress Team Member Plugin

Plugin:
WP Team – WordPress Team Member Plugin
Plugin Slug:
ht-team-member
Installations
700+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.1.8
Severity Score:
Medium
CVE:
2025-49309
The vulnerability has been patched, so you should update to version 1.1.8.

POEditor

Plugin:
POEditor
Plugin Slug:
poeditor
Installations
700+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
0.9.11
Severity Score:
High
CVE:
2025-49237
The vulnerability has been patched, so you should update to version 0.9.11.

WC MyParcel Belgium

Plugin:
WC MyParcel Belgium
Plugin Slug:
wc-myparcel-belgium
Installations
700+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
4.5.6
Severity Score:
High
CVE:
2025-48279
The vulnerability has been patched, so you should update to version 4.5.6.

WP Page Loading

Plugin:
WP Page Loading
Plugin Slug:
wp-page-loading
Installations
700+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
1.0.7
Severity Score:
Medium
CVE:
2025-49317
The vulnerability has been patched, so you should update to version 1.0.7.

WP Plugin Info Card

Plugin:
WP Plugin Info Card
Plugin Slug:
wp-plugin-info-card
Installations
700+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
5.4.0
Severity Score:
Medium
CVE:
2025-5116
The vulnerability has been patched, so you should update to version 5.4.0.

Search with Typesense

Plugin:
Search with Typesense
Plugin Slug:
search-with-typesense
Installations
600+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.0.11
Severity Score:
Medium
CVE:
2025-49304
The vulnerability has been patched, so you should update to version 2.0.11.

Verge3D Publishing and E-Commerce

Plugin:
Verge3D Publishing and E-Commerce
Plugin Slug:
verge3d
Installations
600+
Vulnerability:
Broken Access Control
Patched in Version:
4.9.5
Severity Score:
Medium
CVE:
2025-49268
The vulnerability has been patched, so you should update to version 4.9.5.

404 Page by SeedProd

Plugin:
404 Page by SeedProd
Plugin Slug:
404-page
Installations
500+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.0.2
Severity Score:
Medium
CVE:
2025-49322
The vulnerability has been patched, so you should update to version 1.0.2.

DocsPress – Online Documentation

Plugin:
DocsPress – Online Documentation
Plugin Slug:
docspress
Installations
500+
Vulnerability:
Broken Access Control
Patched in Version:
2.5.3
Severity Score:
Medium
CVE:
2025-49240
The vulnerability has been patched, so you should update to version 2.5.3.

Job Board Manager

Plugin:
Job Board Manager
Plugin Slug:
job-board-manager
Installations
500+
Vulnerability:
Broken Access Control
Patched in Version:
2.1.61
Severity Score:
Medium
CVE:
2025-49324
The vulnerability has been patched, so you should update to version 2.1.61.

WebHotelier for WordPress

Plugin:
WebHotelier for WordPress
Plugin Slug:
webhotelier
Installations
500+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.10.0
Severity Score:
Medium
CVE:
2025-49299
The vulnerability has been patched, so you should update to version 1.10.0.

Audio Editor & Recorder

Plugin:
Audio Editor & Recorder
Plugin Slug:
audio-editor-recorder
Installations
200+
Vulnerability:
Broken Access Control
Patched in Version:
2.2.2
Severity Score:
Medium
CVE:
2025-49509
The vulnerability has been patched, so you should update to version 2.2.2.

Knowledge Base

Plugin:
Knowledge Base
Plugin Slug:
knowledgebase
Installations
100+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.3.1
Severity Score:
Medium
CVE:
2025-5533
The vulnerability has been patched, so you should update to version 2.3.1.

MyStyle Custom Product Designer

Plugin:
MyStyle Custom Product Designer
Plugin Slug:
mystyle-custom-product-designer
Installations
80+
Vulnerability:
SQL Injection
Patched in Version:
3.21.2
Severity Score:
Critical
CVE:
2025-48281
The vulnerability has been patched, so you should update to version 3.21.2.

LTL Freight Quotes – Day & Ross Edition

Plugin:
LTL Freight Quotes – Day & Ross Edition
Plugin Slug:
ltl-freight-quotes-day-ross-edition
Installations
10+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.1.11
Severity Score:
High
CVE:
2025-5303
The vulnerability has been patched, so you should update to version 2.1.11.

Art Theme

Plugin:
Art Theme
Plugin Slug:
art-theme
Vulnerability:
Broken Access Control
Patched in Version:
3.12.3
Severity Score:
Medium
CVE:
2025-1778
The vulnerability has been patched, so you should update to version 3.12.3.

Civi Framework

Plugin:
Civi Framework
Plugin Slug:
civi-framework
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
2.1.6.4
Severity Score:
High
CVE:
2025-49511
The vulnerability has been patched, so you should update to version 2.1.6.4.

Crawlomatic Multisite Scraper Post Generator

Plugin:
Crawlomatic Multisite Scraper Post Generator
Plugin Slug:
crawlomatic-multipage-scraper-post-generator
Vulnerability:
Sensitive Data Exposure
Patched in Version:
2.6.9
Severity Score:
Medium
CVE:
2025-49294
The vulnerability has been patched, so you should update to version 2.6.9.

Crawlomatic Multisite Scraper Post Generator

Plugin:
Crawlomatic Multisite Scraper Post Generator
Plugin Slug:
crawlomatic-multipage-scraper-post-generator
Vulnerability:
Broken Access Control
Patched in Version:
2.6.9
Severity Score:
Medium
CVE:
2025-49293
The vulnerability has been patched, so you should update to version 2.6.9.

LTL Freight Quotes – Daylight Edition

Plugin:
LTL Freight Quotes – Daylight Edition
Plugin Slug:
ltl-freight-quotes-daylight-edition
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.2.7
Severity Score:
High
CVE:
2025-5303
The vulnerability has been patched, so you should update to version 2.2.7.

LTL Freight Quotes – Freightview Edition

Plugin:
LTL Freight Quotes – Freightview Edition
Plugin Slug:
ltl-freight-quotes-freightview-edition
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.0.12
Severity Score:
High
CVE:
2025-5303
The vulnerability has been patched, so you should update to version 1.0.12.

Modern Events Calendar Lite

Plugin:
Modern Events Calendar Lite
Plugin Slug:
modern-events-calendar-lite
Vulnerability:
Sensitive Data Exposure
Patched in Version:
7.22
Severity Score:
Medium
CVE:
2025-5733
The vulnerability has been patched, so you should update to version 7.22.

Nasa Core

Plugin:
Nasa Core
Plugin Slug:
nasa-core
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
6.4.1
Severity Score:
Medium
CVE:
2025-49067
The vulnerability has been patched, so you should update to version 6.4.1.

BRW

Plugin:
BRW
Plugin Slug:
ova-brw
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.8.7
Severity Score:
Medium
CVE:
2025-49314
The vulnerability has been patched, so you should update to version 1.8.7.

BRW

Plugin:
BRW
Plugin Slug:
ova-brw
Vulnerability:
Local File Inclusion
Patched in Version:
1.8.7
Severity Score:
High
CVE:
2025-49313
The vulnerability has been patched, so you should update to version 1.8.7.

NewsLetter

Plugin:
NewsLetter
Plugin Slug:
plugin-newsletter
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
8.8.5
Severity Score:
Medium
CVE:
2025-3581
The vulnerability has been patched, so you should update to version 8.8.5.

NewsLetter

Plugin:
NewsLetter
Plugin Slug:
plugin-newsletter
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
8.8.2
Severity Score:
Medium
CVE:
2025-3584
The vulnerability has been patched, so you should update to version 8.8.2.

Real Cookie Banner Pro

Plugin:
Real Cookie Banner Pro
Plugin Slug:
real-cookie-banner-pro
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
5.1.6
Severity Score:
Medium
CVE:
2025-1485
The vulnerability has been patched, so you should update to version 5.1.6.

Team Showcase

Plugin:
Team Showcase
Plugin Slug:
team-showcase-cm
Vulnerability:
Content Injection
Patched in Version:
25.05.13
Severity Score:
Medium
CVE:
2025-49250
The vulnerability has been patched, so you should update to version 25.05.13.

Team Showcase

Plugin:
Team Showcase
Plugin Slug:
team-showcase-cm
Vulnerability:
Broken Access Control
Patched in Version:
25.05.13
Severity Score:
Medium
CVE:
2025-49248
The vulnerability has been patched, so you should update to version 25.05.13.

Testimonials Showcase

Plugin:
Testimonials Showcase
Plugin Slug:
testimonials-showcase
Vulnerability:
Broken Access Control
Patched in Version:
1.9.18
Severity Score:
Medium
CVE:
2025-49246
The vulnerability has been patched, so you should update to version 1.9.18.

Abandoned Cart Pro for WooCommerce

Plugin:
Abandoned Cart Pro for WooCommerce
Plugin Slug:
woocommerce-abandon-cart-pro
Vulnerability:
Arbitrary File Upload
Patched in Version:
9.17.0
Severity Score:
Critical
CVE:
2025-4387
The vulnerability has been patched, so you should update to version 9.17.0.

WP User Frontend Pro

Plugin:
WP User Frontend Pro
Plugin Slug:
wp-user-frontend-pro
Vulnerability:
Arbitrary File Upload
Patched in Version:
4.1.4
Severity Score:
Critical
CVE:
2025-3054
The vulnerability has been patched, so you should update to version 4.1.4.

WP User Frontend Pro

Plugin:
WP User Frontend Pro
Plugin Slug:
wp-user-frontend-pro
Vulnerability:
Arbitrary File Deletion
Patched in Version:
4.1.4
Severity Score:
High
CVE:
2025-3055
The vulnerability has been patched, so you should update to version 4.1.4.

wpForo Advanced Attachments

Plugin:
wpForo Advanced Attachments
Plugin Slug:
wpforo-advanced-attachments
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.2.0
Severity Score:
High
CVE:
2025-4224
The vulnerability has been patched, so you should update to version 3.2.0.

WordPress Themes — 14 Patched / 21 Unpatched

Arlo

Theme:
Arlo
Theme Slug:
arlo
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-39475
The vulnerability has not been patched. You should switch themes.

BodyCenter – Gym, Fitness WooCommerce WordPress Theme

Theme:
BodyCenter – Gym, Fitness WooCommerce WordPress Theme
Theme Slug:
bodycenter
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2023-25999
The vulnerability has not been patched. You should switch themes.

CraftXtore

Theme:
CraftXtore
Theme Slug:
bw-craftxtore
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-24770
The vulnerability has not been patched. You should switch themes.

Fitrush

Theme:
Fitrush
Theme Slug:
bw-fitrush
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2023-26005
The vulnerability has not been patched. You should switch themes.

GiftXtore

Theme:
GiftXtore
Theme Slug:
bw-giftxtore
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-28888
The vulnerability has not been patched. You should switch themes.

Petito

Theme:
Petito
Theme Slug:
bw-petito
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-27362
The vulnerability has not been patched. You should switch themes.

Car Repair Services

Theme:
Car Repair Services
Theme Slug:
car-repair-services
Vulnerability:
Server Side Request Forgery (SSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2025-30997
The vulnerability has not been patched. You should switch themes.

Themify Edmin

Theme:
Themify Edmin
Theme Slug:
edmin
Vulnerability:
PHP Object Injection
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-31047
The vulnerability has not been patched. You should switch themes.

FLAP – Business WordPress Theme

Theme:
FLAP – Business WordPress Theme
Theme Slug:
flap
Vulnerability:
PHP Object Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2025-31396
The vulnerability has not been patched. You should switch themes.

FlatNews

Theme:
FlatNews
Theme Slug:
flatnews
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-32305
The vulnerability has not been patched. You should switch themes.

Inset

Theme:
Inset
Theme Slug:
inset
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-26592
The vulnerability has not been patched. You should switch themes.

Krowd

Theme:
Krowd
Theme Slug:
krowd
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-32595
The vulnerability has not been patched. You should switch themes.

PIMP – Creative MultiPurpose

Theme:
PIMP – Creative MultiPurpose
Theme Slug:
pimp
Vulnerability:
Deserialization of untrusted data
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2025-31398
The vulnerability has not been patched. You should switch themes.

PressGrid – Frontend Publish Reaction & Multimedia Theme

Theme:
PressGrid – Frontend Publish Reaction & Multimedia Theme
Theme Slug:
press-grid
Vulnerability:
Deserialization of untrusted data
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2025-31429
The vulnerability has not been patched. You should switch themes.

Revo

Theme:
Revo
Theme Slug:
revo
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-39476
The vulnerability has not been patched. You should switch themes.

SNS Anton

Theme:
SNS Anton
Theme Slug:
snsanton
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-28992
The vulnerability has not been patched. You should switch themes.

Avaz

Theme:
Avaz
Theme Slug:
snsavaz
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-28944
The vulnerability has not been patched. You should switch themes.

Nitan

Theme:
Nitan
Theme Slug:
snsnitan
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-24768
The vulnerability has not been patched. You should switch themes.

Soho Hotel

Theme:
Soho Hotel
Theme Slug:
soho-hotel
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-39539
The vulnerability has not been patched. You should switch themes.

Spare

Theme:
Spare
Theme Slug:
spare
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-31638
The vulnerability has not been patched. You should switch themes.

Valen – Sport, Fashion WooCommerce WordPress Theme

Theme:
Valen – Sport, Fashion WooCommerce WordPress Theme
Theme Slug:
valen
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
High
CVE:
2025-28945
The vulnerability has not been patched. You should switch themes.

Courtney

Theme:
Courtney
Theme Slug:
courtney
Vulnerability:
Local File Inclusion
Patched in Version:
1.3.1
Severity Score:
High
CVE:
2025-48290
The vulnerability has been patched, so you should update to version 1.3.1.

CozyStay

Theme:
CozyStay
Theme Slug:
cozystay
Vulnerability:
PHP Object Injection
Patched in Version:
1.7.1
Severity Score:
Critical
CVE:
2025-49507
The vulnerability has been patched, so you should update to version 1.7.1.

GrandPrix

Theme:
GrandPrix
Theme Slug:
grandprix
Vulnerability:
Local File Inclusion
Patched in Version:
1.6.1
Severity Score:
High
CVE:
2025-49296
The vulnerability has been patched, so you should update to version 1.6.1.

Grill and Chow

Theme:
Grill and Chow
Theme Slug:
grillandchow
Vulnerability:
Local File Inclusion
Patched in Version:
1.6.1
Severity Score:
High
CVE:
2025-49297
The vulnerability has been patched, so you should update to version 1.6.1.

Lesya

Theme:
Lesya
Theme Slug:
lesya
Vulnerability:
Local File Inclusion
Patched in Version:
1.7.3
Severity Score:
High
CVE:
2025-48290
The vulnerability has been patched, so you should update to version 1.7.3.

Lettery

Theme:
Lettery
Theme Slug:
lettery
Vulnerability:
Local File Inclusion
Patched in Version:
1.1.8
Severity Score:
High
CVE:
2025-48290
The vulnerability has been patched, so you should update to version 1.1.8.

MediClinic

Theme:
MediClinic
Theme Slug:
mediclinic
Vulnerability:
Local File Inclusion
Patched in Version:
2.2
Severity Score:
High
CVE:
2025-49295
The vulnerability has been patched, so you should update to version 2.2.

Minterio

Theme:
Minterio
Theme Slug:
minterio
Vulnerability:
Local File Inclusion
Patched in Version:
1.4.1
Severity Score:
High
CVE:
2025-48290
The vulnerability has been patched, so you should update to version 1.4.1.

Mr. Murphy

Theme:
Mr. Murphy
Theme Slug:
mr-murphy
Vulnerability:
PHP Object Injection
Patched in Version:
1.2.12.1
Severity Score:
Critical
CVE:
2025-49072
The vulnerability has been patched, so you should update to version 1.2.12.1.

RealHomes

Theme:
RealHomes
Theme Slug:
realhomes
Vulnerability:
Privilege Escalation
Patched in Version:
4.4.1
Severity Score:
High
CVE:
2025-4601
The vulnerability has been patched, so you should update to version 4.4.1.

Starbelly

Theme:
Starbelly
Theme Slug:
starbelly
Vulnerability:
Local File Inclusion
Patched in Version:
1.3.7
Severity Score:
High
CVE:
2025-48290
The vulnerability has been patched, so you should update to version 1.3.7.

Sweet Dessert

Theme:
Sweet Dessert
Theme Slug:
sweet-dessert
Vulnerability:
PHP Object Injection
Patched in Version:
1.1.13
Severity Score:
Critical
CVE:
2025-49073
The vulnerability has been patched, so you should update to version 1.1.13.

TinySalt

Theme:
TinySalt
Theme Slug:
tinysalt
Vulnerability:
PHP Object Injection
Patched in Version:
3.10.0
Severity Score:
Critical
CVE:
2025-49455
The vulnerability has been patched, so you should update to version 3.10.0.

TinySalt

Theme:
TinySalt
Theme Slug:
tinysalt
Vulnerability:
Local File Inclusion
Patched in Version:
3.10.0
Severity Score:
High
CVE:
2025-49454
The vulnerability has been patched, so you should update to version 3.10.0.

Solid Security is part of Solid Suite — The best foundation for WordPress websites.

Every WordPress site needs security, backups, and management tools. That’s Solid Suite — an integrated bundle of three plugins: Solid Security, Solid Backups, and Solid Central. You also get access to Solid Academy’s learning resources for WordPress professionals. Build your next WordPress website on a solid foundation with Solid Suite!

Get Solid Security

Author:

Avatar photoSarah Ulmer

Sarah has been with SolidWP since 2015. Thanks to her deep connection to the brand, its products, and its users, Sarah was tapped as Solid’s primary Product Marketer in 2023. Sarah helps ensure that Solid’s product development team understands our users’ needs. When not at work, Sarah can be found at home with her husband, their three boys, and their dogs. Sarah enjoys long family walks, running with her lab, and watching her three boys play soccer. Sarah is originally from Texas and loves watching football games (Go Longhorns!)

Browse all of Sarah's articles

Author:

Avatar photoSarah Ulmer

Sarah has been with SolidWP since 2015. Thanks to her deep connection to the brand, its products, and its users, Sarah was tapped as Solid’s primary Product Marketer in 2023. Sarah helps ensure that Solid’s product development team understands our users’ needs. When not at work, Sarah can be found at home with her husband, their three boys, and their dogs. Sarah enjoys long family walks, running with her lab, and watching her three boys play soccer. Sarah is originally from Texas and loves watching football games (Go Longhorns!)

Browse all of Sarah's articles