Nexcess.comServers.comLiquidWeb.com
Line illustration showing a black application window on a dark black to purple gradient background overlaid with a large exclamation point alert icon and three bugs.

WordPress Vulnerability Report � April 30, 2025

[email protected]
Uncategorized

In this report, 241 vulnerabilities have been publicly disclosed. Security patches for 91 of these plugins and themes are available now, so run those updates as soon as possible. If you’re a Solid Security Pro user, the version management tool may have already warned you and updated these plugins, depending on your settings.

Additionally, there are 150 plugin and theme vulnerabilities, and no patch has been available yet. If you’re a Solid Security Pro user, those vulnerabilities are already protected by the Solid Security firewall. Virtual patches from Patchstack will be applied when a vulnerability is considered high or medium risk. If no patch is forthcoming from the vendor or the vulnerable software has been marked “closed” and dropped from the official WordPress repositories, you should deactivate it soon and look for alternative solutions.

SolidWP Patches Multiple Plugin Vulnerabilities

On April 29, SolidWP released important security updates across several plugins, including Solid Mail, Solid Performance, Solid Security, and Solid Backups Legacy. These address an unauthenticated XSS (CVE-2025-1123), a serialized injection risk, and a telemetry privilege issue. Users are strongly urged to update immediately.

Read the full advisory and update instructions.

WordPress Core

WordPress 6.8 “Cecil” is here! Launched April 15, 2025, it honors jazz legend Cecil Taylor, whose pioneering piano fused chaos and harmony. Explore its bold features with the same experimental spirit.

Plus, WordCamp Europe 2025 lands in Basel, Switzerland, June 5-7! Connect with WordPress enthusiasts, developers, and pros for three days of learning, networking, and collaboration with the global community.

WordPress Plugins � 85 Patched / 137 Unpatched

Advanced Accordion Gutenberg Block

Plugin:

Advanced Accordion Gutenberg Block

Plugin Slug:
advanced-accordion-block

Installations
7,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-2543


The vulnerability has not been patched. You should deactivate the plugin.

Lottie Player- Great Lottie Player Solution

Plugin:

Lottie Player- Great Lottie Player Solution

Plugin Slug:
embed-lottie-player

Installations
5,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-2579


The vulnerability has not been patched. You should deactivate the plugin.

ACF: Google Font Selector

Plugin:

ACF: Google Font Selector

Plugin Slug:
acf-google-font-selector-field

Installations
3,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-39382


The vulnerability has not been patched. You should deactivate the plugin.

Anything Popup

Plugin:

Anything Popup

Plugin Slug:
anything-popup

Installations
3,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-39397


The vulnerability has not been patched. You should deactivate the plugin.

The Pack Elementor addon

Plugin:

The Pack Elementor addon

Plugin Slug:
the-pack-addon

Installations
2,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-46472


The vulnerability has not been patched. You should deactivate the plugin.

WPMasterToolKit (WPMTK) � All in one plugin

Plugin:

WPMasterToolKit (WPMTK) � All in one plugin

Plugin Slug:
wpmastertoolkit

Installations
2,000+

Vulnerability:
Path Traversal

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-3300


The vulnerability has not been patched. You should deactivate the plugin.

Capturly

Plugin:

Capturly

Plugin Slug:
capturly-optimize-your-website

Installations
100+

Vulnerability:
Local File Inclusion

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-39379


The vulnerability has not been patched. You should deactivate the plugin.

Checkout Field Visibility for WooCommerce

Plugin:

Checkout Field Visibility for WooCommerce

Plugin Slug:
checkout-field-visibility-for-woocommerce

Installations
80+

Vulnerability:
Local File Inclusion

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-39391


The vulnerability has not been patched. You should deactivate the plugin.

Product Lister for eBay

Plugin:

Product Lister for eBay

Plugin Slug:
product-lister-ebay

Installations
70+

Vulnerability:
Local File Inclusion

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-39384


The vulnerability has not been patched. You should deactivate the plugin.

FuseDesk

Plugin:

FuseDesk

Plugin Slug:
fusedesk

Installations
60+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-3832


The vulnerability has not been patched. You should deactivate the plugin.

Appsero Helper

Plugin:

Appsero Helper

Plugin Slug:
appsero-helper

Installations
50+

Vulnerability:
SQL Injection

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-39377


The vulnerability has not been patched. You should deactivate the plugin.

1 Decembrie 1918

Plugin:

1 Decembrie 1918

Plugin Slug:
1-decembrie-1918

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-3870


The vulnerability has not been patched. You should deactivate the plugin.

360 View

Plugin:

360 View

Plugin Slug:
360-view

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-46509


The vulnerability has not been patched. You should deactivate the plugin.

Form Builder

Plugin:

Form Builder

Plugin Slug:
abcsubmit

Vulnerability:
Content Injection

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-2801


The vulnerability has not been patched. You should deactivate the plugin.

Absolute Links

Plugin:

Absolute Links

Plugin Slug:
absolute-links

Vulnerability:
SQL Injection

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-43833


The vulnerability has not been patched. You should deactivate the plugin.

Add custom page template

Plugin:

Add custom page template

Plugin Slug:
add-custom-page-template

Vulnerability:
Remote Code Execution (RCE)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-3491


The vulnerability has not been patched. You should deactivate the plugin.

Add Google +1 (Plus one) social share Button

Plugin:

Add Google +1 (Plus one) social share Button

Plugin Slug:
add-google-plus-one-social-share-button

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-3866


The vulnerability has not been patched. You should deactivate the plugin.

Custom Admin-Bar Favorites

Plugin:

Custom Admin-Bar Favorites

Plugin Slug:
admin-bookmarks

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-3868


The vulnerability has not been patched. You should deactivate the plugin.

Advanced lazy load

Plugin:

Advanced lazy load

Plugin Slug:
advanced-lazy-load

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-46508


The vulnerability has not been patched. You should deactivate the plugin.

All in One Time Clock Lite

Plugin:

All in One Time Clock Lite

Plugin Slug:
aio-time-clock-lite

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-46513


The vulnerability has not been patched. You should deactivate the plugin.

Ajax Comment Form CST

Plugin:

Ajax Comment Form CST

Plugin Slug:
ajax-comment-form-cst

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-3867


The vulnerability has not been patched. You should deactivate the plugin.

Configurator Theme Core

Plugin:

Configurator Theme Core

Plugin Slug:
amz-configurator-core

Vulnerability:
Privilege Escalation

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-3101


The vulnerability has not been patched. You should deactivate the plugin.

Animate

Plugin:

Animate

Plugin Slug:
animate

Vulnerability:
Server Side Request Forgery (SSRF)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-46443


The vulnerability has not been patched. You should deactivate the plugin.

Author Box After Posts

Plugin:

Author Box After Posts

Plugin Slug:
author-box-after-posts

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-46263


The vulnerability has not been patched. You should deactivate the plugin.

Author Box Plugin With Different Description

Plugin:

Author Box Plugin With Different Description

Plugin Slug:
author-box-with-different-description

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-39371


The vulnerability has not been patched. You should deactivate the plugin.

Availability Calendar

Plugin:

Availability Calendar

Plugin Slug:
availability

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-46528


The vulnerability has not been patched. You should deactivate the plugin.

Awesome Wp Image Gallery

Plugin:

Awesome Wp Image Gallery

Plugin Slug:
awesome-wp-post-459209 wp-image-gallery

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-46476


The vulnerability has not been patched. You should deactivate the plugin.

BBCode Deluxe

Plugin:

BBCode Deluxe

Plugin Slug:
bbcode-deluxe

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-46479


The vulnerability has not been patched. You should deactivate the plugin.

Best Posts Summary

Plugin:

Best Posts Summary

Plugin Slug:
best-posts-summary

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-39374


The vulnerability has not been patched. You should deactivate the plugin.

Blog Manager WP

Plugin:

Blog Manager WP

Plugin Slug:
blog-manager-wp

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-46517


The vulnerability has not been patched. You should deactivate the plugin.

Buddypress Force Password Change

Plugin:

Buddypress Force Password Change

Plugin Slug:
buddy-press-force-password-change

Vulnerability:
Broken Access Control

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-3793


The vulnerability has not been patched. You should deactivate the plugin.

Business Contact Widget

Plugin:

Business Contact Widget

Plugin Slug:
business-contact-widget

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-46529


The vulnerability has not been patched. You should deactivate the plugin.

Call Now PHT Blog

Plugin:

Call Now PHT Blog

Plugin Slug:
call-now-coccoc-pht-blog

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-46492


The vulnerability has not been patched. You should deactivate the plugin.

Car Park Booking System for WordPress

Plugin:

Car Park Booking System for WordPress

Plugin Slug:
car-park-booking-system-for-wordpress

Vulnerability:
Broken Access Control

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-39376


The vulnerability has not been patched. You should deactivate the plugin.

Carousel-of-post-images

Plugin:

Carousel-of-post-images

Plugin Slug:
carousel-of-post-images

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-46536


The vulnerability has not been patched. You should deactivate the plugin.

Contact Form 7 Calendar

Plugin:

Contact Form 7 Calendar

Plugin Slug:
cf7-calendar

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-46510


The vulnerability has not been patched. You should deactivate the plugin.

CheckBot

Plugin:

CheckBot

Plugin Slug:
checkbot

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-43840


The vulnerability has not been patched. You should deactivate the plugin.

Confirm User Registration

Plugin:

Confirm User Registration

Plugin Slug:
confirm-user-registration

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-46459


The vulnerability has not been patched. You should deactivate the plugin.

COVID-19 (Coronavirus) Update Your Customers

Plugin:

COVID-19 (Coronavirus) Update Your Customers

Plugin Slug:
covid-19-alert

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-46523


The vulnerability has not been patched. You should deactivate the plugin.

Custom Functions Plugin

Plugin:

Custom Functions Plugin

Plugin Slug:
custom-functions

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-46512


The vulnerability has not been patched. You should deactivate the plugin.

WP Custom Post Popup

Plugin:

WP Custom Post Popup

Plugin Slug:
custom-post-popup

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-46471


The vulnerability has not been patched. You should deactivate the plugin.

LSD Custom taxonomy and category meta

Plugin:

LSD Custom taxonomy and category meta

Plugin Slug:
custom-taxonomy-category-and-term-fields

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-46502


The vulnerability has not been patched. You should deactivate the plugin.

Document Management System

Plugin:

Document Management System

Plugin Slug:
dms

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-46448


The vulnerability has not been patched. You should deactivate the plugin.

Drop Caps

Plugin:

Drop Caps

Plugin Slug:
drop-caps

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-46495


The vulnerability has not been patched. You should deactivate the plugin.

Dropdown Content

Plugin:

Dropdown Content

Plugin Slug:
dropdown-content

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-46478


The vulnerability has not been patched. You should deactivate the plugin.

Easy Child Theme Creator

Plugin:

Easy Child Theme Creator

Plugin Slug:
easy-child-theme-creator

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-39375


The vulnerability has not been patched. You should deactivate the plugin.

Enhanced Paypal Shortcodes

Plugin:

Enhanced Paypal Shortcodes

Plugin Slug:
enhanced-paypal-shortcodes

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-46543


The vulnerability has not been patched. You should deactivate the plugin.

External Markdown

Plugin:

External Markdown

Plugin Slug:
external-markdown

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-46445


The vulnerability has not been patched. You should deactivate the plugin.

FAT Services Booking

Plugin:

FAT Services Booking

Plugin Slug:
fat-services-booking

Vulnerability:
SQL Injection

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-39355


The vulnerability has not been patched. You should deactivate the plugin.

Flickr Shortcode Importer

Plugin:

Flickr Shortcode Importer

Plugin Slug:
flickr-shortcode-importer

Vulnerability:
PHP Object Injection

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-46481


The vulnerability has not been patched. You should deactivate the plugin.

Floating Social Bar

Plugin:

Floating Social Bar

Plugin Slug:
floating-social-bar

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-46451


The vulnerability has not been patched. You should deactivate the plugin.

Flynax Bridge

Plugin:

Flynax Bridge

Plugin Slug:
flynax-bridge

Vulnerability:
Privilege Escalation

Patched in Version:
No Fix

Severity Score:
Critical

CVE:

2025-3603


The vulnerability has not been patched. You should deactivate the plugin.

Flynax Bridge

Plugin:

Flynax Bridge

Plugin Slug:
flynax-bridge

Vulnerability:
Privilege Escalation

Patched in Version:
No Fix

Severity Score:
Critical

CVE:

2025-3604


The vulnerability has not been patched. You should deactivate the plugin.

Foodbakery Sticky Cart

Plugin:

Foodbakery Sticky Cart

Plugin Slug:
foodbakery-sticky-cart

Vulnerability:
PHP Object Injection

Patched in Version:
No Fix

Severity Score:
Critical

CVE:

2025-39356


The vulnerability has not been patched. You should deactivate the plugin.

Front End Users

Plugin:

Front End Users

Plugin Slug:
front-end-only-users

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2024-13569


The vulnerability has not been patched. You should deactivate the plugin.

Frontend Login and Registration Blocks

Plugin:

Frontend Login and Registration Blocks

Plugin Slug:
frontend-login-and-registration-blocks

Vulnerability:
Privilege Escalation

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-3607


The vulnerability has not been patched. You should deactivate the plugin.

GNA Search Shortcode

Plugin:

GNA Search Shortcode

Plugin Slug:
gna-search-shortcode

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-46540


The vulnerability has not been patched. You should deactivate the plugin.

Peadig�s Google +1 Button

Plugin:

Peadig�s Google +1 Button

Plugin Slug:
google-1

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-46483


The vulnerability has not been patched. You should deactivate the plugin.

Google News

Plugin:

Google News

Plugin Slug:
google-news

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-46452


The vulnerability has not been patched. You should deactivate the plugin.

Grand Conference

Plugin:

Grand Conference

Plugin Slug:
grandconference

Vulnerability:
PHP Object Injection

Patched in Version:
No Fix

Severity Score:
Critical

CVE:

2025-39354


The vulnerability has not been patched. You should deactivate the plugin.

Tabs

Plugin:

Tabs

Plugin Slug:
gt-tabs

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-46522


The vulnerability has not been patched. You should deactivate the plugin.

GTDB Guitar Tuners

Plugin:

GTDB Guitar Tuners

Plugin Slug:
guitar-tuner

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-46438


The vulnerability has not been patched. You should deactivate the plugin.

Hacklog Remote Attachment

Plugin:

Hacklog Remote Attachment

Plugin Slug:
hacklog-remote-attachment

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-46530


The vulnerability has not been patched. You should deactivate the plugin.

Smart Hashtags [#hashtagger]

Plugin:

Smart Hashtags [#hashtagger]

Plugin Slug:
hashtagger

Vulnerability:
Broken Access Control

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-46470


The vulnerability has not been patched. You should deactivate the plugin.

Hospital Management System

Plugin:

Hospital Management System

Plugin Slug:
hospital-management

Vulnerability:
Arbitrary File Upload

Patched in Version:
No Fix

Severity Score:
Critical

CVE:

2025-39380


The vulnerability has not been patched. You should deactivate the plugin.

Hospital Management System

Plugin:

Hospital Management System

Plugin Slug:
hospital-management

Vulnerability:
SQL Injection

Patched in Version:
No Fix

Severity Score:
Critical

CVE:

2025-39386


The vulnerability has not been patched. You should deactivate the plugin.

Hospital Management System

Plugin:

Hospital Management System

Plugin Slug:
hospital-management

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-39393


The vulnerability has not been patched. You should deactivate the plugin.

Hospital Management System

Plugin:

Hospital Management System

Plugin Slug:
hospital-management

Vulnerability:
SQL Injection

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-39357


The vulnerability has not been patched. You should deactivate the plugin.

iCafe Library

Plugin:

iCafe Library

Plugin Slug:
icafe-library

Vulnerability:
SQL Injection

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-39370


The vulnerability has not been patched. You should deactivate the plugin.

Image Style Hover

Plugin:

Image Style Hover

Plugin Slug:
image-content-show-hover

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-46534


The vulnerability has not been patched. You should deactivate the plugin.

Image Hover Effects For WPBakery Page Builder

Plugin:

Image Hover Effects For WPBakery Page Builder

Plugin Slug:
image-hover-effects-for-visual-composer

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-46484


The vulnerability has not been patched. You should deactivate the plugin.

Inline Text Popup

Plugin:

Inline Text Popup

Plugin Slug:
inline-text-popup

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-46538


The vulnerability has not been patched. You should deactivate the plugin.

Integra��o entre Eduzz e Woocommerce

Plugin:

Integra��o entre Eduzz e Woocommerce

Plugin Slug:
integracao-entre-eduzz-e-wc-powers

Vulnerability:
Privilege Escalation

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-3906


The vulnerability has not been patched. You should deactivate the plugin.

Landing pages and Domain aliases for WordPress

Plugin:

Landing pages and Domain aliases for WordPress

Plugin Slug:
landing-pages-and-domain-aliases

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-46533


The vulnerability has not been patched. You should deactivate the plugin.

Libro de Reclamaciones

Plugin:

Libro de Reclamaciones

Plugin Slug:
libro-de-reclamaciones

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-46446


The vulnerability has not been patched. You should deactivate the plugin.

License For Envato

Plugin:

License For Envato

Plugin Slug:
license-envato

Vulnerability:
Local File Inclusion

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-39399


The vulnerability has not been patched. You should deactivate the plugin.

Mad Mimi for WordPress

Plugin:

Mad Mimi for WordPress

Plugin Slug:
mad-mimi

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-46262


The vulnerability has not been patched. You should deactivate the plugin.

Milat jQuery Automatic Popup

Plugin:

Milat jQuery Automatic Popup

Plugin Slug:
milat-jquery-automatic-popup

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-46514


The vulnerability has not been patched. You should deactivate the plugin.

Mini twitter feed

Plugin:

Mini twitter feed

Plugin Slug:
mini-twitter-feed

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-46496


The vulnerability has not been patched. You should deactivate the plugin.

Mixcloud Embed

Plugin:

Mixcloud Embed

Plugin Slug:
mixcloud-embed

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-46501


The vulnerability has not been patched. You should deactivate the plugin.

Modern Polls

Plugin:

Modern Polls

Plugin Slug:
modern-polls

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-46466


The vulnerability has not been patched. You should deactivate the plugin.

Custom Login and Registration

Plugin:

Custom Login and Registration

Plugin Slug:
ms-registration

Vulnerability:
Broken Access Control

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-46535


The vulnerability has not been patched. You should deactivate the plugin.

Multi-Column Taxonomy List

Plugin:

Multi-Column Taxonomy List

Plugin Slug:
multi-column-taxonomy-list

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-46491


The vulnerability has not been patched. You should deactivate the plugin.

My Custom Widgets

Plugin:

My Custom Widgets

Plugin Slug:
mycustomwidget

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-46526


The vulnerability has not been patched. You should deactivate the plugin.

Navegg Analytics

Plugin:

Navegg Analytics

Plugin Slug:
navegg

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-46497


The vulnerability has not been patched. You should deactivate the plugin.

Nepali Post Date

Plugin:

Nepali Post Date

Plugin Slug:
nepali-post-date

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-46480


The vulnerability has not been patched. You should deactivate the plugin.

occupancyplan

Plugin:

occupancyplan

Plugin Slug:
occupancyplan

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-46450


The vulnerability has not been patched. You should deactivate the plugin.

PayPal Express Checkout

Plugin:

PayPal Express Checkout

Plugin Slug:
paypal-express-checkout

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-46499


The vulnerability has not been patched. You should deactivate the plugin.

Peekaboo

Plugin:

Peekaboo

Plugin Slug:
peekaboo

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-46505


The vulnerability has not been patched. You should deactivate the plugin.

Plugin Central

Plugin:

Plugin Central

Plugin Slug:
plugin-central

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-46439


The vulnerability has not been patched. You should deactivate the plugin.

Posts for Page

Plugin:

Posts for Page

Plugin Slug:
posts-for-page

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-39369


The vulnerability has not been patched. You should deactivate the plugin.

Print Science Designer

Plugin:

Print Science Designer

Plugin Slug:
print-science-designer

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-46465


The vulnerability has not been patched. You should deactivate the plugin.

RAphicon

Plugin:

RAphicon

Plugin Slug:
raphicon

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-46467


The vulnerability has not been patched. You should deactivate the plugin.

Related Posts via Taxonomies

Plugin:

Related Posts via Taxonomies

Plugin Slug:
related-posts-via-taxonomies

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-46520


The vulnerability has not been patched. You should deactivate the plugin.

Loan Calculator

Plugin:

Loan Calculator

Plugin Slug:
repayment-calculator

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-46442


The vulnerability has not been patched. You should deactivate the plugin.

Revy

Plugin:

Revy

Plugin Slug:
revy

Vulnerability:
SQL Injection

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-32924


The vulnerability has not been patched. You should deactivate the plugin.

SUMO Reward Points

Plugin:

SUMO Reward Points

Plugin Slug:
rewardsystem

Vulnerability:
Local File Inclusion

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-32925


The vulnerability has not been patched. You should deactivate the plugin.

RRSSB

Plugin:

RRSSB

Plugin Slug:
rrssb

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-46461


The vulnerability has not been patched. You should deactivate the plugin.

SCSS-Library

Plugin:

SCSS-Library

Plugin Slug:
scss-library

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-46436


The vulnerability has not been patched. You should deactivate the plugin.

Send From

Plugin:

Send From

Plugin Slug:
send-from

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-46469


The vulnerability has not been patched. You should deactivate the plugin.

SEUR Oficial

Plugin:

SEUR Oficial

Plugin Slug:
seur

Vulnerability:
Local File Inclusion

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-46474


The vulnerability has not been patched. You should deactivate the plugin.

Simple Google Photos Grid

Plugin:

Simple Google Photos Grid

Plugin Slug:
simple-google-photos-grid

Vulnerability:
Server Side Request Forgery (SSRF)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-46503


The vulnerability has not been patched. You should deactivate the plugin.

Social Counter

Plugin:

Social Counter

Plugin Slug:
social-counter

Vulnerability:
PHP Object Injection

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-46473


The vulnerability has not been patched. You should deactivate the plugin.

Tayori Form

Plugin:

Tayori Form

Plugin Slug:
tayori

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-46437


The vulnerability has not been patched. You should deactivate the plugin.

Time Based Greeting

Plugin:

Time Based Greeting

Plugin Slug:
time-based-greeting

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-46435


The vulnerability has not been patched. You should deactivate the plugin.

Twitter Card Generator

Plugin:

Twitter Card Generator

Plugin Slug:
twitter-card-generator

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-46516


The vulnerability has not been patched. You should deactivate the plugin.

Unsafe Mimetypes

Plugin:

Unsafe Mimetypes

Plugin Slug:
unsafe-mimetypes

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-46507


The vulnerability has not been patched. You should deactivate the plugin.

Vasaio QR Code

Plugin:

Vasaio QR Code

Plugin Slug:
vasaio-qr-code

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-46504


The vulnerability has not been patched. You should deactivate the plugin.

WP Vegas

Plugin:

WP Vegas

Plugin Slug:
vegas-fullscreen-background-slider

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-43841


The vulnerability has not been patched. You should deactivate the plugin.

Verification SMS with TargetSMS

Plugin:

Verification SMS with TargetSMS

Plugin Slug:
verification-sms-targetsms

Vulnerability:
Remote Code Execution (RCE)

Patched in Version:
No Fix

Severity Score:
Critical

CVE:

2025-3776


The vulnerability has not been patched. You should deactivate the plugin.

Bulk Assign Linked Products For WooCommerce

Plugin:

Bulk Assign Linked Products For WooCommerce

Plugin Slug:
wc-bulk-assign-linked-products

Vulnerability:
Broken Access Control

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-46489


The vulnerability has not been patched. You should deactivate the plugin.

WP AVCL Automation Helper (formerly WPFlyLeads)

Plugin:

WP AVCL Automation Helper (formerly WPFlyLeads)

Plugin Slug:
woozap

Vulnerability:
Server Side Request Forgery (SSRF)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-46531


The vulnerability has not been patched. You should deactivate the plugin.

Plugin Upgrade Time Out

Plugin:

Plugin Upgrade Time Out

Plugin Slug:
wordpressplugin-upgrade-time-out-plugin

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2024-8243


The vulnerability has not been patched. You should deactivate the plugin.

WoWHead Tooltips

Plugin:

WoWHead Tooltips

Plugin Slug:
wowhead-tooltips

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-46449


The vulnerability has not been patched. You should deactivate the plugin.

WP Cookie Consent

Plugin:

WP Cookie Consent

Plugin Slug:
wp-cookie-consent

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-46525


The vulnerability has not been patched. You should deactivate the plugin.

Wp Custom CMS Block

Plugin:

Wp Custom CMS Block

Plugin Slug:
wp-custom-cms-block

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-46457


The vulnerability has not been patched. You should deactivate the plugin.

WP Customize Login Page

Plugin:

WP Customize Login Page

Plugin Slug:
wp-customize-login-page

Vulnerability:
Broken Access Control

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-46485


The vulnerability has not been patched. You should deactivate the plugin.

WP Customize Login Page

Plugin:

WP Customize Login Page

Plugin Slug:
wp-customize-login-page

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-46477


The vulnerability has not been patched. You should deactivate the plugin.

wp-cyr-cho

Plugin:

wp-cyr-cho

Plugin Slug:
wp-cyr-cho

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-43835


The vulnerability has not been patched. You should deactivate the plugin.

Easy Guide

Plugin:

Easy Guide

Plugin Slug:
wp-easy-guide

Vulnerability:
SQL Injection

Patched in Version:
No Fix

Severity Score:
Critical

CVE:

2025-46460


The vulnerability has not been patched. You should deactivate the plugin.

WP Filter Post Category

Plugin:

WP Filter Post Category

Plugin Slug:
wp-filter-post-categories

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-46524


The vulnerability has not been patched. You should deactivate the plugin.

FoodBakery

Plugin:

FoodBakery

Plugin Slug:
wp-foodbakery

Vulnerability:
PHP Object Injection

Patched in Version:
No Fix

Severity Score:
Critical

CVE:

2025-32927


The vulnerability has not been patched. You should deactivate the plugin.

WP HRM LITE

Plugin:

WP HRM LITE

Plugin Slug:
wp-hrm-lite-human-resource-management-system

Vulnerability:
SQL Injection

Patched in Version:
No Fix

Severity Score:
Critical

CVE:

2025-46455


The vulnerability has not been patched. You should deactivate the plugin.

JobSearch

Plugin:

JobSearch

Plugin Slug:
wp-jobsearch

Vulnerability:
Broken Authentication

Patched in Version:
No Fix

Severity Score:
High

CVE:

2024-11917


The vulnerability has not been patched. You should deactivate the plugin.

Meta Keywords & Description

Plugin:

Meta Keywords & Description

Plugin Slug:
wp-meta-keywords-meta-description

Vulnerability:
Local File Inclusion

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-46454


The vulnerability has not been patched. You should deactivate the plugin.

WP Quiz

Plugin:

WP Quiz

Plugin Slug:
wp-quiz

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-46482


The vulnerability has not been patched. You should deactivate the plugin.

WP-reCAPTCHA-bp

Plugin:

WP-reCAPTCHA-bp

Plugin Slug:
wp-recaptcha-bp

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-46541


The vulnerability has not been patched. You should deactivate the plugin.

Tooltip

Plugin:

Tooltip

Plugin Slug:
wp-tooltip

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-46532


The vulnerability has not been patched. You should deactivate the plugin.

WordPress Events Calendar Registration & Tickets

Plugin:

WordPress Events Calendar Registration & Tickets

Plugin Slug:
wpeventplus

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-39372


The vulnerability has not been patched. You should deactivate the plugin.

WPVN

Plugin:

WPVN

Plugin Slug:
wpvn-username-changer

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-46462


The vulnerability has not been patched. You should deactivate the plugin.

WpZon � Amazon Affiliate Plugin

Plugin:

WpZon � Amazon Affiliate Plugin

Plugin Slug:
wpzon

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-46506


The vulnerability has not been patched. You should deactivate the plugin.

WS Force Login Page

Plugin:

WS Force Login Page

Plugin Slug:
ws-force-login-page

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-46521


The vulnerability has not been patched. You should deactivate the plugin.

Woocommerce Automatic Order Printing

Plugin:

Woocommerce Automatic Order Printing

Plugin Slug:
xc-woo-google-cloud-print

Vulnerability:
Insecure Direct Object References (IDOR)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-1284


The vulnerability has not been patched. You should deactivate the plugin.

Xpert Tab

Plugin:

Xpert Tab

Plugin Slug:
xpert-tab

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-46542


The vulnerability has not been patched. You should deactivate the plugin.

Zalo Official Live Chat

Plugin:

Zalo Official Live Chat

Plugin Slug:
zalo-official-live-chat

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-46498


The vulnerability has not been patched. You should deactivate the plugin.

Zoho Creator Forms

Plugin:

Zoho Creator Forms

Plugin Slug:
zohocreator

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-46453


The vulnerability has not been patched. You should deactivate the plugin.

Ocean Extra

Plugin:

Ocean Extra

Plugin Slug:
ocean-extra

Installations
600,000+

Vulnerability:
Content Injection

Patched in Version:
2.4.7

Severity Score:
Medium

CVE:

2025-3472


The vulnerability has been patched, so you should update to version 2.4.7.

Ocean Extra

Plugin:

Ocean Extra

Plugin Slug:
ocean-extra

Installations
600,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
2.4.7

Severity Score:
Medium

CVE:

2025-3457


The vulnerability has been patched, so you should update to version 2.4.7.

Admin and Site Enhancements (ASE)

Plugin:

Admin and Site Enhancements (ASE)

Plugin Slug:
admin-site-enhancements

Installations
100,000+

Vulnerability:
Bypass Vulnerability

Patched in Version:
7.6.10

Severity Score:
Medium

CVE:

2024-13688


The vulnerability has been patched, so you should update to version 7.6.10.

Jupiter X Core

Plugin:

Jupiter X Core

Plugin Slug:
jupiterx-core

Installations
90,000+

Vulnerability:
PHP Object Injection

Patched in Version:
4.8.12

Severity Score:
Critical

CVE:

2025-2105


The vulnerability has been patched, so you should update to version 4.8.12.

Category Posts Widget

Plugin:

Category Posts Widget

Plugin Slug:
category-posts

Installations
50,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
4.9.20

Severity Score:
Medium

CVE:

2025-1453


The vulnerability has been patched, so you should update to version 4.9.20.

Greenshift � animation and page builder blocks

Plugin:

Greenshift � animation and page builder blocks

Plugin Slug:
greenshift-animation-and-page-builder-blocks

Installations
50,000+

Vulnerability:
Arbitrary File Upload

Patched in Version:
11.4.6

Severity Score:
High

CVE:

2025-3616


The vulnerability has been patched, so you should update to version 11.4.6.

Visual Composer Website Builder

Plugin:

Visual Composer Website Builder

Plugin Slug:
visualcomposer

Installations
50,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
45.11.0

Severity Score:
Medium

CVE:

2025-46254


The vulnerability has been patched, so you should update to version 45.11.0.

WP Import Export Lite

Plugin:

WP Import Export Lite

Plugin Slug:
wp-import-export-lite

Installations
50,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
3.9.28

Severity Score:
Medium

CVE:

2025-2839


The vulnerability has been patched, so you should update to version 3.9.28.

SecuPress Free � WordPress Security

Plugin:

SecuPress Free � WordPress Security

Plugin Slug:
secupress

Installations
40,000+

Vulnerability:
Broken Access Control

Patched in Version:
2.3.10

Severity Score:
Medium

CVE:

2025-3452


The vulnerability has been patched, so you should update to version 2.3.10.

Social Slider Feed

Plugin:

Social Slider Feed

Plugin Slug:
instagram-slider-widget

Installations
30,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
2.2.9

Severity Score:
Medium

CVE:

2025-0717


The vulnerability has been patched, so you should update to version 2.2.9.

PowerPress Podcasting plugin by Blubrry

Plugin:

PowerPress Podcasting plugin by Blubrry

Plugin Slug:
powerpress

Installations
30,000+

Vulnerability:
Arbitrary File Upload

Patched in Version:
11.12.6

Severity Score:
Critical

CVE:

2025-46264


The vulnerability has been patched, so you should update to version 11.12.6.

Seriously Simple Podcasting

Plugin:

Seriously Simple Podcasting

Plugin Slug:
seriously-simple-podcasting

Installations
20,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
3.10.0

Severity Score:
Medium

CVE:

2025-46261


The vulnerability has been patched, so you should update to version 3.10.0.

AFI � The Easiest Integration Plugin

Plugin:

AFI � The Easiest Integration Plugin

Plugin Slug:
advanced-form-integration

Installations
10,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
1.100.0

Severity Score:
Medium

CVE:

2024-13123


The vulnerability has been patched, so you should update to version 1.100.0.

HTML Forms � Simple WordPress Forms Plugin

Plugin:

HTML Forms � Simple WordPress Forms Plugin

Plugin Slug:
html-forms

Installations
10,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
1.5.3

Severity Score:
Medium

CVE:

2025-46236


The vulnerability has been patched, so you should update to version 1.5.3.

Link Library

Plugin:

Link Library

Plugin Slug:
link-library

Installations
10,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
7.8.1

Severity Score:
Medium

CVE:

2025-46237


The vulnerability has been patched, so you should update to version 7.8.1.

Mang Board WP

Plugin:

Mang Board WP

Plugin Slug:
mangboard

Installations
10,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
1.8.7

Severity Score:
Medium

CVE:

2025-3435


The vulnerability has been patched, so you should update to version 1.8.7.

Prevent Direct Access � Protect WordPress Files

Plugin:

Prevent Direct Access � Protect WordPress Files

Plugin Slug:
prevent-direct-access

Installations
10,000+

Vulnerability:
Sensitive Data Exposure

Patched in Version:
2.8.8.1

Severity Score:
Medium

CVE:

2025-3923


The vulnerability has been patched, so you should update to version 2.8.8.1.

Prevent Direct Access � Protect WordPress Files

Plugin:

Prevent Direct Access � Protect WordPress Files

Plugin Slug:
prevent-direct-access

Installations
10,000+

Vulnerability:
Broken Access Control

Patched in Version:
2.8.8.3

Severity Score:
Medium

CVE:

2025-3861


The vulnerability has been patched, so you should update to version 2.8.8.3.

WordPress Simple Shopping Cart

Plugin:

WordPress Simple Shopping Cart

Plugin Slug:
wordpress-simple-paypal-shopping-cart

Installations
10,000+

Vulnerability:
Bypass Vulnerability

Patched in Version:
5.1.3

Severity Score:
Medium

CVE:

2025-3530


The vulnerability has been patched, so you should update to version 5.1.3.

WordPress Simple Shopping Cart

Plugin:

WordPress Simple Shopping Cart

Plugin Slug:
wordpress-simple-paypal-shopping-cart

Installations
10,000+

Vulnerability:
Sensitive Data Exposure

Patched in Version:
5.1.3

Severity Score:
Medium

CVE:

2025-3529


The vulnerability has been patched, so you should update to version 5.1.3.

Custom Related Posts

Plugin:

Custom Related Posts

Plugin Slug:
custom-related-posts

Installations
4,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
1.7.5

Severity Score:
Medium

CVE:

2025-46227


The vulnerability has been patched, so you should update to version 1.7.5.

Upsell Funnel Builder for WooCommerce

Plugin:

Upsell Funnel Builder for WooCommerce

Plugin Slug:
upsell-order-bump-offer-for-woocommerce

Installations
4,000+

Vulnerability:
Other Vulnerability Type

Patched in Version:
3.0.1

Severity Score:
Medium

CVE:

2025-3743


The vulnerability has been patched, so you should update to version 3.0.1.

Watu Quiz

Plugin:

Watu Quiz

Plugin Slug:
watu

Installations
4,000+

Vulnerability:
SQL Injection

Patched in Version:
3.4.4

Severity Score:
High

CVE:

2025-46242


The vulnerability has been patched, so you should update to version 3.4.4.

affiliate-toolkit � WP Affiliate Plugin with Amazon

Plugin:

affiliate-toolkit � WP Affiliate Plugin with Amazon

Plugin Slug:
affiliate-toolkit-starter

Installations
2,000+

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
3.7.4

Severity Score:
Medium

CVE:

2025-46231


The vulnerability has been patched, so you should update to version 3.7.4.

Message Filter for Contact Form 7

Plugin:

Message Filter for Contact Form 7

Plugin Slug:
cf7-message-filter

Installations
2,000+

Vulnerability:
SQL Injection

Patched in Version:
1.6.33

Severity Score:
High

CVE:

2025-46252


The vulnerability has been patched, so you should update to version 1.6.33.

SKT Blocks � Gutenberg based Page Builder

Plugin:

SKT Blocks � Gutenberg based Page Builder

Plugin Slug:
skt-blocks

Installations
2,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
2.1

Severity Score:
Medium

CVE:

2025-46235


The vulnerability has been patched, so you should update to version 2.1.

Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blog, Video Gallery)

Plugin:

Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blog, Video Gallery)

Plugin Slug:
sky-elementor-addons

Installations
2,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
3.0.3

Severity Score:
Medium

CVE:

2025-46260


The vulnerability has been patched, so you should update to version 3.0.3.

WP-Recall � Registration, Profile, Commerce & More

Plugin:

WP-Recall � Registration, Profile, Commerce & More

Plugin Slug:
wp-recall

Installations
2,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
16.26.12

Severity Score:
Medium

CVE:

2024-9771


The vulnerability has been patched, so you should update to version 16.26.12.

Appointment Booking Calendar

Plugin:

Appointment Booking Calendar

Plugin Slug:
appointment-booking-calendar

Installations
1,000+

Vulnerability:
Broken Access Control

Patched in Version:
1.3.93

Severity Score:
Medium

CVE:

2025-46247


The vulnerability has been patched, so you should update to version 1.3.93.

Appointment Booking Calendar

Plugin:

Appointment Booking Calendar

Plugin Slug:
appointment-booking-calendar

Installations
1,000+

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
1.3.93

Severity Score:
High

CVE:

2025-46241


The vulnerability has been patched, so you should update to version 1.3.93.

Event post

Plugin:

Event post

Plugin Slug:
event-post

Installations
1,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
5.10.0

Severity Score:
Medium

CVE:

2025-46228


The vulnerability has been patched, so you should update to version 5.10.0.

Fable Extra

Plugin:

Fable Extra

Plugin Slug:
fable-extra

Installations
1,000+

Vulnerability:
SQL Injection

Patched in Version:
1.0.7

Severity Score:
Critical

CVE:

2025-46539


The vulnerability has been patched, so you should update to version 1.0.7.

Fable Extra

Plugin:

Fable Extra

Plugin Slug:
fable-extra

Installations
1,000+

Vulnerability:
Local File Inclusion

Patched in Version:
1.0.7

Severity Score:
Critical

CVE:

2025-46468


The vulnerability has been patched, so you should update to version 1.0.7.

Fable Extra

Plugin:

Fable Extra

Plugin Slug:
fable-extra

Installations
1,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
1.0.7

Severity Score:
Medium

CVE:

2025-46447


The vulnerability has been patched, so you should update to version 1.0.7.

List Last Changes

Plugin:

List Last Changes

Plugin Slug:
list-last-changes

Installations
1,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
1.2.2

Severity Score:
Medium

CVE:

2025-46238


The vulnerability has been patched, so you should update to version 1.2.2.

Simple Download Counter

Plugin:

Simple Download Counter

Plugin Slug:
simple-download-counter

Installations
1,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
2.2.1

Severity Score:
Medium

CVE:

2025-46240


The vulnerability has been patched, so you should update to version 2.2.1.

Image Optimizer, Resizer and CDN � Sirv

Plugin:

Image Optimizer, Resizer and CDN � Sirv

Plugin Slug:
sirv

Installations
1,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
7.5.4

Severity Score:
Medium

CVE:

2025-46233


The vulnerability has been patched, so you should update to version 7.5.4.

Smart Maintenance Mode

Plugin:

Smart Maintenance Mode

Plugin Slug:
smart-maintenance-mode

Installations
1,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
1.5.2

Severity Score:
Medium

CVE:

2024-12683


The vulnerability has been patched, so you should update to version 1.5.2.

My Tickets � Accessible Event Ticketing

Plugin:

My Tickets � Accessible Event Ticketing

Plugin Slug:
my-tickets

Installations
900+

Vulnerability:
Privilege Escalation

Patched in Version:
2.0.17

Severity Score:
High

CVE:

2025-3761


The vulnerability has been patched, so you should update to version 2.0.17.

MPL-Publisher � Ebook & Audiobook Creator

Plugin:

MPL-Publisher � Ebook & Audiobook Creator

Plugin Slug:
mpl-publisher

Installations
800+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
2.18.1

Severity Score:
Medium

CVE:

2025-46226


The vulnerability has been patched, so you should update to version 2.18.1.

Frontend Dashboard

Plugin:

Frontend Dashboard

Plugin Slug:
frontend-dashboard

Installations
700+

Vulnerability:
SQL Injection

Patched in Version:
2.2.6

Severity Score:
Critical

CVE:

2025-46248


The vulnerability has been patched, so you should update to version 2.2.6.

Media Library Downloader

Plugin:

Media Library Downloader

Plugin Slug:
media-library-downloader

Installations
700+

Vulnerability:
Broken Access Control

Patched in Version:
1.3.2

Severity Score:
Medium

CVE:

2025-46519


The vulnerability has been patched, so you should update to version 1.3.2.

Popup Builder

Plugin:

Popup Builder

Plugin Slug:
easy-notify-lite

Installations
600+

Vulnerability:
Local File Inclusion

Patched in Version:
1.1.37

Severity Score:
High

CVE:

2025-46230


The vulnerability has been patched, so you should update to version 1.1.37.

VikRestaurants Table Reservations and Take-Away

Plugin:

VikRestaurants Table Reservations and Take-Away

Plugin Slug:
vikrestaurants

Installations
600+

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
1.4

Severity Score:
High

CVE:

2025-46251


The vulnerability has been patched, so you should update to version 1.4.

Textmetrics

Plugin:

Textmetrics

Plugin Slug:
webtexttool

Installations
600+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
3.6.3

Severity Score:
Medium

CVE:

2025-46229


The vulnerability has been patched, so you should update to version 3.6.3.

Crossword Compiler Puzzles

Plugin:

Crossword Compiler Puzzles

Plugin Slug:
crossword-compiler-puzzles

Installations
400+

Vulnerability:
Arbitrary File Upload

Patched in Version:
5.3

Severity Score:
Critical

CVE:

2025-46490


The vulnerability has been patched, so you should update to version 5.3.

Advanced Linked Variations for Woocommerce

Plugin:

Advanced Linked Variations for Woocommerce

Plugin Slug:
linked-variation

Installations
400+

Vulnerability:
Broken Access Control

Patched in Version:
1.0.4

Severity Score:
Medium

CVE:

2025-46244


The vulnerability has been patched, so you should update to version 1.0.4.

Simple calendar for Elementor

Plugin:

Simple calendar for Elementor

Plugin Slug:
simple-calendar-for-elementor

Installations
400+

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
1.6.5

Severity Score:
Medium

CVE:

2025-46249


The vulnerability has been patched, so you should update to version 1.6.5.

Tax Switch for WooCommerce

Plugin:

Tax Switch for WooCommerce

Plugin Slug:
tax-switch-for-woocommerce

Installations
300+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
1.4.3

Severity Score:
Medium

CVE:

2025-3814


The vulnerability has been patched, so you should update to version 1.4.3.

Mailing Group Listserv

Plugin:

Mailing Group Listserv

Plugin Slug:
wp-mailing-group

Installations
200+

Vulnerability:
SQL Injection

Patched in Version:
3.0.5

Severity Score:
High

CVE:

2025-46463


The vulnerability has been patched, so you should update to version 3.0.5.

Able Player, accessible HTML5 media player

Plugin:

Able Player, accessible HTML5 media player

Plugin Slug:
ableplayer

Installations
100+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
1.2.2

Severity Score:
Medium

CVE:

2025-46475


The vulnerability has been patched, so you should update to version 1.2.2.

Recover abandoned cart for WooCommerce

Plugin:

Recover abandoned cart for WooCommerce

Plugin Slug:
recover-wc-abandoned-cart

Installations
100+

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
2.3

Severity Score:
Medium

CVE:

2025-46243


The vulnerability has been patched, so you should update to version 2.3.

Breeze Display

Plugin:

Breeze Display

Plugin Slug:
wt-display-breeze

Installations
90+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
1.2.4

Severity Score:
Medium

CVE:

2025-3749


The vulnerability has been patched, so you should update to version 1.2.4.

Aeropage Sync for Airtable

Plugin:

Aeropage Sync for Airtable

Plugin Slug:
aeropage-sync-for-airtable

Installations
70+

Vulnerability:
Broken Access Control

Patched in Version:
3.3.0

Severity Score:
Medium

CVE:

2025-3915


The vulnerability has been patched, so you should update to version 3.3.0.

Aeropage Sync for Airtable

Plugin:

Aeropage Sync for Airtable

Plugin Slug:
aeropage-sync-for-airtable

Installations
70+

Vulnerability:
Arbitrary File Upload

Patched in Version:
3.3.0

Severity Score:
High

CVE:

2025-3914


The vulnerability has been patched, so you should update to version 3.3.0.

AnalyticsWP

Plugin:

AnalyticsWP

Plugin Slug:
analyticswp

Vulnerability:
SQL Injection

Patched in Version:
2.1.5

Severity Score:
Critical

CVE:

2025-39389


The vulnerability has been patched, so you should update to version 2.1.5.

Anps Theme

Plugin:

Anps Theme

Plugin Slug:
anps_theme_plugin

Vulnerability:
Content Injection

Patched in Version:
1.1.2

Severity Score:
Medium

CVE:

2024-13812


The vulnerability has been patched, so you should update to version 1.1.2.

BeerXML Shortcode

Plugin:

BeerXML Shortcode

Plugin Slug:
beerxml-shortcode

Vulnerability:
Server Side Request Forgery (SSRF)

Patched in Version:
0.8

Severity Score:
Medium

CVE:

2025-46511


The vulnerability has been patched, so you should update to version 0.8.

BM Content Builder

Plugin:

BM Content Builder

Plugin Slug:
bm-builder

Vulnerability:
Broken Access Control

Patched in Version:
3.16.3

Severity Score:
High

CVE:

2025-1279


The vulnerability has been patched, so you should update to version 3.16.3.

cookieBAR

Plugin:

cookieBAR

Plugin Slug:
cookiebar

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
1.10.1

Severity Score:
Medium

CVE:

2025-43834


The vulnerability has been patched, so you should update to version 1.10.1.

Mayosis Core

Plugin:

Mayosis Core

Plugin Slug:
mayosis-core

Vulnerability:
Arbitrary File Download

Patched in Version:
5.4.2

Severity Score:
High

CVE:

2025-1565


The vulnerability has been patched, so you should update to version 5.4.2.

Memberpress

Plugin:

Memberpress

Plugin Slug:
memberpress

Vulnerability:
Sensitive Data Exposure

Patched in Version:
1.12.0

Severity Score:
Medium

CVE:

2024-11299


The vulnerability has been patched, so you should update to version 1.12.0.

Order Delivery Date for WP e-Commerce

Plugin:

Order Delivery Date for WP e-Commerce

Plugin Slug:
order-delivery-date

Vulnerability:
Privilege Escalation

Patched in Version:
12.3.1

Severity Score:
Critical

CVE:

2025-2907


The vulnerability has been patched, so you should update to version 12.3.1.

Post in page for Elementor

Plugin:

Post in page for Elementor

Plugin Slug:
post-in-page-for-elementor

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
1.0.2

Severity Score:
Medium

CVE:

2025-46225


The vulnerability has been patched, so you should update to version 1.0.2.

Service Finder Booking

Plugin:

Service Finder Booking

Plugin Slug:
sf-booking

Vulnerability:
Privilege Escalation

Patched in Version:
6.0

Severity Score:
Critical

CVE:

2025-2470


The vulnerability has been patched, so you should update to version 6.0.

eForm – WordPress Form Builder

Plugin:

eForm – WordPress Form Builder

Plugin Slug:
wp-fsqm-pro

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
4.19

Severity Score:
High

CVE:

2025-1294


The vulnerability has been patched, so you should update to version 4.19.

Xpro Elementor Addons – Pro

Plugin:

Xpro Elementor Addons – Pro

Plugin Slug:
xpro-elementor-addons-pro

Vulnerability:
Remote Code Execution (RCE)

Patched in Version:
1.4.10

Severity Score:
High

CVE:

2024-13808


The vulnerability has been patched, so you should update to version 1.4.10.

WordPress Themes � 6 Patched / 13 Unpatched

Arrival

Theme:

Arrival

Theme Slug:
arrival

Downloads
126,548

Vulnerability:
Local File Inclusion

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-32921


The vulnerability has not been patched. You should switch themes.

CWW Portfolio

Theme:

CWW Portfolio

Theme Slug:
cww-portfolio

Downloads
85,776

Vulnerability:
Local File Inclusion

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-39359


The vulnerability has not been patched. You should switch themes.

Grace Mag

Theme:

Grace Mag

Theme Slug:
grace-mag

Downloads
70,110

Vulnerability:
Local File Inclusion

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-39360


The vulnerability has not been patched. You should switch themes.

Opstore

Theme:

Opstore

Theme Slug:
opstore

Downloads
82,188

Vulnerability:
Local File Inclusion

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-39387


The vulnerability has not been patched. You should switch themes.

Xews Lite

Theme:

Xews Lite

Theme Slug:
xews-lite

Downloads
14,655

Vulnerability:
Local File Inclusion

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-39383


The vulnerability has not been patched. You should switch themes.

Altair

Theme:

Altair

Theme Slug:
altair

Vulnerability:
PHP Object Injection

Patched in Version:
No Fix

Severity Score:
Critical

CVE:

2025-32928


The vulnerability has not been patched. You should switch themes.

Hotel + Bed and Breakfast Booking Calendar Theme | Bellevue

Theme:

Hotel + Bed and Breakfast Booking Calendar Theme | Bellevue

Theme Slug:
bellevuex

Vulnerability:
Broken Access Control

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-39398


The vulnerability has not been patched. You should switch themes.

CiyaShop

Theme:

CiyaShop

Theme Slug:
ciyashop

Vulnerability:
PHP Object Injection

Patched in Version:
No Fix

Severity Score:
Critical

CVE:

2025-39349


The vulnerability has not been patched. You should switch themes.

Grand Restaurant WordPress

Theme:

Grand Restaurant WordPress

Theme Slug:
grandrestaurant

Vulnerability:
PHP Object Injection

Patched in Version:
No Fix

Severity Score:
Critical

CVE:

2025-39348


The vulnerability has not been patched. You should switch themes.

Grand Restaurant WordPress

Theme:

Grand Restaurant WordPress

Theme Slug:
grandrestaurant

Vulnerability:
Arbitrary Content Deletion

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-39352


The vulnerability has not been patched. You should switch themes.

Grand Restaurant WordPress

Theme:

Grand Restaurant WordPress

Theme Slug:
grandrestaurant

Vulnerability:
Path Traversal

Patched in Version:
No Fix

Severity Score:
Critical

CVE:

2025-32926


The vulnerability has not been patched. You should switch themes.

JNews

Theme:

JNews

Theme Slug:
jnews

Vulnerability:
Broken Access Control

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-39373


The vulnerability has not been patched. You should switch themes.

Reales WP

Theme:

Reales WP

Theme Slug:
reales-wp-real-estate-wordpress-theme

Vulnerability:
Broken Access Control

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2024-13307


The vulnerability has not been patched. You should switch themes.

EduMall

Theme:

EduMall

Theme Slug:
edumall

Vulnerability:
Local File Inclusion

Patched in Version:
4.3.0

Severity Score:
High

CVE:

2025-2101


The vulnerability has been patched, so you should update to version 4.3.0.

Kleo

Theme:

Kleo

Theme Slug:
kleo

Vulnerability:
Broken Access Control

Patched in Version:
5.4.4

Severity Score:
Medium

CVE:

2025-39367


The vulnerability has been patched, so you should update to version 5.4.4.

Vikinger

Theme:

Vikinger

Theme Slug:
vikinger

Vulnerability:
Privilege Escalation

Patched in Version:
1.9.31

Severity Score:
High

CVE:

2025-2238


The vulnerability has been patched, so you should update to version 1.9.31.

wProject

Theme:

wProject

Theme Slug:
wproject

Vulnerability:
Privilege Escalation

Patched in Version:
5.8.0

Severity Score:
High

CVE:

2025-39366


The vulnerability has been patched, so you should update to version 5.8.0.

wProject

Theme:

wProject

Theme Slug:
wproject

Vulnerability:
Settings Change

Patched in Version:
5.8.0

Severity Score:
High

CVE:

2025-39350


The vulnerability has been patched, so you should update to version 5.8.0.

wProject

Theme:

wProject

Theme Slug:
wproject

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
5.8.0

Severity Score:
High

CVE:

2025-39365


The vulnerability has been patched, so you should update to version 5.8.0.

Related articles

Uncategorized
Recurring Donations: A Guide for Nonprofits Morgan Hugoboom
Uncategorized
9 Impactful Ways to Say Thank You to Nonprofit Donors Adam Weinger
Uncategorized
Event Ticketing Software: What to Look for Jaime Marchwinski
Uncategorized
WordPress Vulnerability Report � January 1, 2025 Sarah
Uncategorized
How to Use Microlearning in Your Course Alexis Bryan
Uncategorized
WordPress Vulnerability Report – June 8, 2022 SolidWP Editorial Team

Wait! Get exclusive hosting insights

Subscribe to our newsletter and stay ahead of the competition with expert advice from our hosting pros.

Loading form…