Nexcess.comServers.comLiquidWeb.com
Line illustration showing a black application window on a blue gradient background overlaid with a large exclamation point alert icon and three bugs.

WordPress Vulnerability Report � June 11, 2025

[email protected]
Uncategorized

In this report, 306 vulnerabilities have been publicly disclosed. Security patches for 134 of these plugins and themes are available now, so run those updates as soon as possible. If you’re a Solid Security Pro user, the version management tool may have already warned you and updated these plugins, depending on your settings.

Additionally, there are 172 plugin and theme vulnerabilities, and no patch has been available yet. If you’re a Solid Security Pro user, those vulnerabilities are already protected by the Solid Security firewall. Virtual patches from Patchstack will be applied when a vulnerability is considered high or medium risk. If no patch is forthcoming from the vendor or the vulnerable software has been marked “closed” and dropped from the official WordPress repositories, you should deactivate it soon and look for alternative solutions.

WordPress Core

WordPress 6.8.1 was released on April 30, 2025. This maintenance release includes fixes for 15 bugs throughout Core and the Block Editor, addressing issues affecting multiple areas of WordPress, including the block editor, multisite, and REST API. For a full list, refer to the release candidate announcement.

WordPress Plugins � 120 Patched / 151 Unpatched

Widget Logic

Plugin:

Widget Logic

Plugin Slug:
widget-logic

Installations
100,000+

Vulnerability:
Remote Code Execution (RCE)

Patched in Version:
No Fix

Severity Score:
Critical

CVE:

2025-32222


The vulnerability has not been patched. You should deactivate the plugin.

CubeWP � All-in-One Dynamic Content Framework

Plugin:

CubeWP � All-in-One Dynamic Content Framework

Plugin Slug:
cubewp-framework

Installations
5,000+

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-30994


The vulnerability has not been patched. You should deactivate the plugin.

PayU CommercePro Plugin

Plugin:

PayU CommercePro Plugin

Plugin Slug:
payu-india

Installations
5,000+

Vulnerability:
Broken Authentication

Patched in Version:
No Fix

Severity Score:
Critical

CVE:

2025-31022


The vulnerability has not been patched. You should deactivate the plugin.

WP Shopify

Plugin:

WP Shopify

Plugin Slug:
wp-shopify

Installations
4,000+

Vulnerability:
Local File Inclusion

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-30999


The vulnerability has not been patched. You should deactivate the plugin.

Easy Mega Menu Plugin for WordPress � ThemeHunk

Plugin:

Easy Mega Menu Plugin for WordPress � ThemeHunk

Plugin Slug:
themehunk-megamenu-plus

Installations
3,000+

Vulnerability:
Broken Access Control

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-30990


The vulnerability has not been patched. You should deactivate the plugin.

Widgetize Pages Light

Plugin:

Widgetize Pages Light

Plugin Slug:
widgetize-pages-light

Installations
3,000+

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-30995


The vulnerability has not been patched. You should deactivate the plugin.

Premium Packages � Sell Digital Products Securely

Plugin:

Premium Packages � Sell Digital Products Securely

Plugin Slug:
wpdm-premium-packages

Installations
3,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-30991


The vulnerability has not been patched. You should deactivate the plugin.

Category Icon

Plugin:

Category Icon

Plugin Slug:
category-icon

Installations
2,000+

Vulnerability:
XML External Entity (XXE)

Patched in Version:
No Fix

Severity Score:
Critical

CVE:

2025-31039


The vulnerability has not been patched. You should deactivate the plugin.

Post Grid Master � Custom Post Types, Taxonomies & Ajax Filter Everything with Infinite Scroll, Load More, Pagination & Shortcode Builder

Plugin:

Post Grid Master � Custom Post Types, Taxonomies & Ajax Filter Everything with Infinite Scroll, Load More, Pagination & Shortcode Builder

Plugin Slug:
ajax-filter-posts

Installations
1,000+

Vulnerability:
Broken Access Control

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-30974


The vulnerability has not been patched. You should deactivate the plugin.

Booqable Rental Plugin

Plugin:

Booqable Rental Plugin

Plugin Slug:
booqable-rental-reservations

Installations
1,000+

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-30956


The vulnerability has not been patched. You should deactivate the plugin.

Activity Plus Reloaded for BuddyPress

Plugin:

Activity Plus Reloaded for BuddyPress

Plugin Slug:
bp-activity-plus-reloaded

Installations
1,000+

Vulnerability:
Broken Access Control

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-30957


The vulnerability has not been patched. You should deactivate the plugin.

onOffice for WP-Websites

Plugin:

onOffice for WP-Websites

Plugin Slug:
onoffice-for-wp-websites

Installations
1,000+

Vulnerability:
Broken Access Control

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-30958


The vulnerability has not been patched. You should deactivate the plugin.

Simple Keyword to Link

Plugin:

Simple Keyword to Link

Plugin Slug:
simple-keyword-to-link

Installations
1,000+

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-30980


The vulnerability has not been patched. You should deactivate the plugin.

All Currencies for WooCommerce

Plugin:

All Currencies for WooCommerce

Plugin Slug:
woocommerce-all-currencies

Installations
1,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-30950


The vulnerability has not been patched. You should deactivate the plugin.

WP Compress for MainWP

Plugin:

WP Compress for MainWP

Plugin Slug:
wp-compress-mainwp

Installations
900+

Vulnerability:
Broken Access Control

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-30932


The vulnerability has not been patched. You should deactivate the plugin.

???????????????

Plugin:

???????????????

Plugin Slug:
os-diagnosis-generator

Installations
800+

Vulnerability:
Broken Access Control

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-30934


The vulnerability has not been patched. You should deactivate the plugin.

Spice Blocks

Plugin:

Spice Blocks

Plugin Slug:
spice-blocks

Installations
800+

Vulnerability:
Arbitrary File Download

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-48130


The vulnerability has not been patched. You should deactivate the plugin.

ACF: Yandex Maps Field

Plugin:

ACF: Yandex Maps Field

Plugin Slug:
acf-yandex-maps-field

Installations
700+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-30930


The vulnerability has not been patched. You should deactivate the plugin.

Broadly for WordPress

Plugin:

Broadly for WordPress

Plugin Slug:
broadly

Installations
700+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-30938


The vulnerability has not been patched. You should deactivate the plugin.

Bitly URL Shortener

Plugin:

Bitly URL Shortener

Plugin Slug:
codehaveli-bitly-url-shortener

Installations
700+

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-30629


The vulnerability has not been patched. You should deactivate the plugin.

�?????????� ?? DaData.ru

Plugin:

�?????????� ?? DaData.ru

Plugin Slug:
dadata-ru

Installations
700+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-30931


The vulnerability has not been patched. You should deactivate the plugin.

IFrame Widget

Plugin:

IFrame Widget

Plugin Slug:
iframe-widget

Installations
700+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-30939


The vulnerability has not been patched. You should deactivate the plugin.

Melipayamak

Plugin:

Melipayamak

Plugin Slug:
melipayamak

Installations
700+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-30940


The vulnerability has not been patched. You should deactivate the plugin.

Accessibility Suite by Ability, Inc

Plugin:

Accessibility Suite by Ability, Inc

Plugin Slug:
online-accessibility

Installations
700+

Vulnerability:
Broken Access Control

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-30636


The vulnerability has not been patched. You should deactivate the plugin.

Pinterest Verify Meta Tag

Plugin:

Pinterest Verify Meta Tag

Plugin Slug:
pinterest-verify-meta-tag

Installations
700+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-30941


The vulnerability has not been patched. You should deactivate the plugin.

Responsify WP

Plugin:

Responsify WP

Plugin Slug:
responsify-wp

Installations
700+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-30937


The vulnerability has not been patched. You should deactivate the plugin.

Wordapp

Plugin:

Wordapp

Plugin Slug:
wordapp

Installations
700+

Vulnerability:
Broken Access Control

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-30927


The vulnerability has not been patched. You should deactivate the plugin.

WordLift � AI powered SEO � Schema

Plugin:

WordLift � AI powered SEO � Schema

Plugin Slug:
wordlift

Installations
600+

Vulnerability:
Broken Access Control

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-30624


The vulnerability has not been patched. You should deactivate the plugin.

Behance Portfolio Manager

Plugin:

Behance Portfolio Manager

Plugin Slug:
portfolio-manager-powered-by-behance

Installations
500+

Vulnerability:
Broken Access Control

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-29010


The vulnerability has not been patched. You should deactivate the plugin.

Wishlist

Plugin:

Wishlist

Plugin Slug:
wishlist

Installations
500+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-31061


The vulnerability has not been patched. You should deactivate the plugin.

HR Management Lite

Plugin:

HR Management Lite

Plugin Slug:
hr-management-lite

Installations
400+

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-29005


The vulnerability has not been patched. You should deactivate the plugin.

Multi CryptoCurrency Payments

Plugin:

Multi CryptoCurrency Payments

Plugin Slug:
multi-crypto-currency-payment

Installations
400+

Vulnerability:
SQL Injection

Patched in Version:
No Fix

Severity Score:
Critical

CVE:

2025-48141


The vulnerability has not been patched. You should deactivate the plugin.

WP AutoKeyword

Plugin:

WP AutoKeyword

Plugin Slug:
wp-autokeyword

Installations
400+

Vulnerability:
Broken Access Control

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-28997


The vulnerability has not been patched. You should deactivate the plugin.

GPP Slideshow

Plugin:

GPP Slideshow

Plugin Slug:
gpp-slideshow

Installations
300+

Vulnerability:
Broken Access Control

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-28996


The vulnerability has not been patched. You should deactivate the plugin.

Viral Loops WP Integration

Plugin:

Viral Loops WP Integration

Plugin Slug:
viral-loops-wp-integration

Installations
300+

Vulnerability:
Broken Access Control

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-28994


The vulnerability has not been patched. You should deactivate the plugin.

Viral Loops WP Integration

Plugin:

Viral Loops WP Integration

Plugin Slug:
viral-loops-wp-integration

Installations
300+

Vulnerability:
Broken Access Control

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-28995


The vulnerability has not been patched. You should deactivate the plugin.

Elastic Email Subscribe Form

Plugin:

Elastic Email Subscribe Form

Plugin Slug:
elastic-email-subscribe-form

Installations
200+

Vulnerability:
Broken Access Control

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-28985


The vulnerability has not been patched. You should deactivate the plugin.

Epicwin Plugin

Plugin:

Epicwin Plugin

Plugin Slug:
epicwin-subscribers

Installations
200+

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-28986


The vulnerability has not been patched. You should deactivate the plugin.

Read More Login

Plugin:

Read More Login

Plugin Slug:
read-more-login

Installations
200+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-28989


The vulnerability has not been patched. You should deactivate the plugin.

Subscription Renewal Reminders for WooCommerce

Plugin:

Subscription Renewal Reminders for WooCommerce

Plugin Slug:
subscriptions-renewal-reminders

Installations
200+

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-28984


The vulnerability has not been patched. You should deactivate the plugin.

Pay with Contact Form 7

Plugin:

Pay with Contact Form 7

Plugin Slug:
pay-with-contact-form-7

Installations
100+

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-24772


The vulnerability has not been patched. You should deactivate the plugin.

Quick Event Calendar

Plugin:

Quick Event Calendar

Plugin Slug:
quick-event-calendar

Installations
100+

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-27360


The vulnerability has not been patched. You should deactivate the plugin.

Recover abandoned cart for WooCommerce

Plugin:

Recover abandoned cart for WooCommerce

Plugin Slug:
recover-wc-abandoned-cart

Installations
100+

Vulnerability:
SQL Injection

Patched in Version:
No Fix

Severity Score:
Critical

CVE:

2025-47608


The vulnerability has not been patched. You should deactivate the plugin.

WP Media File Type Manager

Plugin:

WP Media File Type Manager

Plugin Slug:
wp-media-file-type-manager

Installations
100+

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-27359


The vulnerability has not been patched. You should deactivate the plugin.

TicketBAI Facturas para WooCommerce

Plugin:

TicketBAI Facturas para WooCommerce

Plugin Slug:
wp-ticketbai

Installations
80+

Vulnerability:
SQL Injection

Patched in Version:
No Fix

Severity Score:
Critical

CVE:

2025-24767


The vulnerability has not been patched. You should deactivate the plugin.

TicketBAI Facturas para WooCommerce

Plugin:

TicketBAI Facturas para WooCommerce

Plugin Slug:
wp-ticketbai

Installations
80+

Vulnerability:
Broken Access Control

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-24762


The vulnerability has not been patched. You should deactivate the plugin.

One-Login

Plugin:

One-Login

Plugin Slug:
one-login

Installations
70+

Vulnerability:
Privilege Escalation

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-23974


The vulnerability has not been patched. You should deactivate the plugin.

Next Event Calendar

Plugin:

Next Event Calendar

Plugin Slug:
next-event-calendar

Installations
60+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2023-26001


The vulnerability has not been patched. You should deactivate the plugin.

WP Post Corrector

Plugin:

WP Post Corrector

Plugin Slug:
wp-post-corrector

Installations
60+

Vulnerability:
SQL Injection

Patched in Version:
No Fix

Severity Score:
High

CVE:

2023-26003


The vulnerability has not been patched. You should deactivate the plugin.

6Storage Rentals

Plugin:

6Storage Rentals

Plugin Slug:
6storage-rentals

Installations
50+

Vulnerability:
Broken Access Control

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2023-26002


The vulnerability has not been patched. You should deactivate the plugin.

Bang tinh vay

Plugin:

Bang tinh vay

Plugin Slug:
bang-tinh-lai-suat

Installations
50+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2023-26000


The vulnerability has not been patched. You should deactivate the plugin.

Sola Support Tickets

Plugin:

Sola Support Tickets

Plugin Slug:
sola-support-tickets

Installations
50+

Vulnerability:
Arbitrary Content Deletion

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2023-25997


The vulnerability has not been patched. You should deactivate the plugin.

Interactive Regional Map of Africa

Plugin:

Interactive Regional Map of Africa

Plugin Slug:
interactive-map-of-africa

Installations
30+

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-49449


The vulnerability has not been patched. You should deactivate the plugin.

SEPA Girocode

Plugin:

SEPA Girocode

Plugin Slug:
sepa-girocode

Installations
30+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-49450


The vulnerability has not been patched. You should deactivate the plugin.

Admin Notes

Plugin:

Admin Notes

Plugin Slug:
admin-note

Installations
20+

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-49446


The vulnerability has not been patched. You should deactivate the plugin.

Interactive UK Regional Map

Plugin:

Interactive UK Regional Map

Plugin Slug:
interactive-uk-regional-map

Installations
20+

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-49445


The vulnerability has not been patched. You should deactivate the plugin.

Bacon Ipsum

Plugin:

Bacon Ipsum

Plugin Slug:
bacon-ipsum

Installations
10+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-49443


The vulnerability has not been patched. You should deactivate the plugin.

Interactive Regional Map of Florida

Plugin:

Interactive Regional Map of Florida

Plugin Slug:
interactive-map-of-florida

Installations
10+

Vulnerability:
Broken Access Control

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-49441


The vulnerability has not been patched. You should deactivate the plugin.

Team Builder

Plugin:

Team Builder

Plugin Slug:
a-team-showcase

Vulnerability:
Broken Access Control

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-32308


The vulnerability has not been patched. You should deactivate the plugin.

Abbie Expander

Plugin:

Abbie Expander

Plugin Slug:
abbie-expander

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-49427


The vulnerability has not been patched. You should deactivate the plugin.

Advanced Post List

Plugin:

Advanced Post List

Plugin Slug:
advanced-post-list

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-30968


The vulnerability has not been patched. You should deactivate the plugin.

AI Mortgage Calculator

Plugin:

AI Mortgage Calculator

Plugin Slug:
ai-mortgage-calculator

Vulnerability:
Local File Inclusion

Patched in Version:
No Fix

Severity Score:
High

CVE:

2023-25995


The vulnerability has not been patched. You should deactivate the plugin.

AppBanners

Plugin:

AppBanners

Plugin Slug:
appbanners

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-30625


The vulnerability has not been patched. You should deactivate the plugin.

Atelier Create CV

Plugin:

Atelier Create CV

Plugin Slug:
atelier-create-cv

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-49439


The vulnerability has not been patched. You should deactivate the plugin.

Backwp

Plugin:

Backwp

Plugin Slug:
backwp

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-28954


The vulnerability has not been patched. You should deactivate the plugin.

bbPress API

Plugin:

bbPress API

Plugin Slug:
bbp-api

Vulnerability:
Broken Access Control

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-24763


The vulnerability has not been patched. You should deactivate the plugin.

Bg Orthodox Calendar

Plugin:

Bg Orthodox Calendar

Plugin Slug:
bg-orthodox-calendar

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-28958


The vulnerability has not been patched. You should deactivate the plugin.

BNS Featured Category

Plugin:

BNS Featured Category

Plugin Slug:
bns-featured-category

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-5538


The vulnerability has not been patched. You should deactivate the plugin.

BP Profile as Homepage

Plugin:

BP Profile as Homepage

Plugin Slug:
bp-profile-as-homepage

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-49453


The vulnerability has not been patched. You should deactivate the plugin.

Bunny�s Print CSS

Plugin:

Bunny�s Print CSS

Plugin Slug:
bunnys-print-css

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-5925


The vulnerability has not been patched. You should deactivate the plugin.

WPCHURCH

Plugin:

WPCHURCH

Plugin Slug:
church-management

Vulnerability:
SQL Injection

Patched in Version:
No Fix

Severity Score:
Critical

CVE:

2025-32303


The vulnerability has not been patched. You should deactivate the plugin.

HyperComments

Plugin:

HyperComments

Plugin Slug:
comments-with-hypercommentscom

Vulnerability:
Privilege Escalation

Patched in Version:
No Fix

Severity Score:
Critical

CVE:

2025-5701


The vulnerability has not been patched. You should deactivate the plugin.

Complete Google Seo Scan

Plugin:

Complete Google Seo Scan

Plugin Slug:
complete-google-seo-scan

Vulnerability:
SQL Injection

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-26590


The vulnerability has not been patched. You should deactivate the plugin.

Contact Form

Plugin:

Contact Form

Plugin Slug:
contact-form-ready

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-30935


The vulnerability has not been patched. You should deactivate the plugin.

WordPress Ajax Load More and Infinite Scroll

Plugin:

WordPress Ajax Load More and Infinite Scroll

Plugin Slug:
cpt-ajax-load-more

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-5586


The vulnerability has not been patched. You should deactivate the plugin.

CubePoints

Plugin:

CubePoints

Plugin Slug:
cubepoints

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-28952


The vulnerability has not been patched. You should deactivate the plugin.

Custom Bulk/Quick Edit

Plugin:

Custom Bulk/Quick Edit

Plugin Slug:
custom-bulkquick-edit

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-30946


The vulnerability has not been patched. You should deactivate the plugin.

Custom Category/Post Type Post order

Plugin:

Custom Category/Post Type Post order

Plugin Slug:
custom-post-order-category

Vulnerability:
Broken Access Control

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-29013


The vulnerability has not been patched. You should deactivate the plugin.

Developer Formatter

Plugin:

Developer Formatter

Plugin Slug:
devformatter

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-5699


The vulnerability has not been patched. You should deactivate the plugin.

Slack Notifications by dorzki

Plugin:

Slack Notifications by dorzki

Plugin Slug:
dorzki-notifications-to-slack

Vulnerability:
Broken Access Control

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-30978


The vulnerability has not been patched. You should deactivate the plugin.

ZoomSounds

Plugin:

ZoomSounds

Plugin Slug:
dzs-zoomsounds

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-47566


The vulnerability has not been patched. You should deactivate the plugin.

Elegant Visitor Counter

Plugin:

Elegant Visitor Counter

Plugin Slug:
elegant-visitor-counter

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-30627


The vulnerability has not been patched. You should deactivate the plugin.

Universal Video Player

Plugin:

Universal Video Player

Plugin Slug:
elementor_widget_universal_video_player

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-31057


The vulnerability has not been patched. You should deactivate the plugin.

elfsight Contact Form widget

Plugin:

elfsight Contact Form widget

Plugin Slug:
elfsight-contact-form

Vulnerability:
Sensitive Data Exposure

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-31045


The vulnerability has not been patched. You should deactivate the plugin.

Elite Video Player

Plugin:

Elite Video Player

Plugin Slug:
elite-video-player

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-30986


The vulnerability has not been patched. You should deactivate the plugin.

Foxit eSign for WordPress

Plugin:

Foxit eSign for WordPress

Plugin Slug:
esign-genie-for-wp

Vulnerability:
Other Vulnerability Type

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-49419


The vulnerability has not been patched. You should deactivate the plugin.

ESV Bible Shortcode for WordPress

Plugin:

ESV Bible Shortcode for WordPress

Plugin Slug:
esv-bible-shortcode-for-wordpress

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-5534


The vulnerability has not been patched. You should deactivate the plugin.

FastBook

Plugin:

FastBook

Plugin Slug:
fastbook-responsive-appointment-booking-and-scheduling-system

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-26593


The vulnerability has not been patched. You should deactivate the plugin.

File Provider

Plugin:

File Provider

Plugin Slug:
file-provider

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-4580


The vulnerability has not been patched. You should deactivate the plugin.

File Provider

Plugin:

File Provider

Plugin Slug:
file-provider

Vulnerability:
SQL Injection

Patched in Version:
No Fix

Severity Score:
Critical

CVE:

2025-4578


The vulnerability has not been patched. You should deactivate the plugin.

Free WP Mail SMTP

Plugin:

Free WP Mail SMTP

Plugin Slug:
free-wp-mail-smtp

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-28974


The vulnerability has not been patched. You should deactivate the plugin.

Global Translator

Plugin:

Global Translator

Plugin Slug:
global-translator

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-30630


The vulnerability has not been patched. You should deactivate the plugin.

Global Translator

Plugin:

Global Translator

Plugin Slug:
global-translator

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-30632


The vulnerability has not been patched. You should deactivate the plugin.

Hide It

Plugin:

Hide It

Plugin Slug:
hide-it

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-5565


The vulnerability has not been patched. You should deactivate the plugin.

Hive Support

Plugin:

Hive Support

Plugin Slug:
hive-support

Vulnerability:
Broken Access Control

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-5018


The vulnerability has not been patched. You should deactivate the plugin.

Hive Support

Plugin:

Hive Support

Plugin Slug:
hive-support

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-5019


The vulnerability has not been patched. You should deactivate the plugin.

Image Hover Effects Block

Plugin:

Image Hover Effects Block

Plugin Slug:
image-hover-effects-block

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-31025


The vulnerability has not been patched. You should deactivate the plugin.

InWave Jobs

Plugin:

InWave Jobs

Plugin Slug:
iwjob

Vulnerability:
Broken Access Control

Patched in Version:
No Fix

Severity Score:
Critical

CVE:

2025-39477


The vulnerability has not been patched. You should deactivate the plugin.

KI Live Video Conferences

Plugin:

KI Live Video Conferences

Plugin Slug:
ki-live-video-conferences

Vulnerability:
Sensitive Data Exposure

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-23969


The vulnerability has not been patched. You should deactivate the plugin.

KI Live Video Conferences

Plugin:

KI Live Video Conferences

Plugin Slug:
ki-live-video-conferences

Vulnerability:
Broken Access Control

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-23971


The vulnerability has not been patched. You should deactivate the plugin.

Konami Easter Egg

Plugin:

Konami Easter Egg

Plugin Slug:
konami-easter-egg

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-49425


The vulnerability has not been patched. You should deactivate the plugin.

Layouts for Elementor

Plugin:

Layouts for Elementor

Plugin Slug:
layouts-for-elementor

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-30948


The vulnerability has not been patched. You should deactivate the plugin.

CLEVER

Plugin:

CLEVER

Plugin Slug:
lbg-audio11-html5-shoutcast_history

Vulnerability:
Arbitrary File Download

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-31635


The vulnerability has not been patched. You should deactivate the plugin.

Sticky Radio Player

Plugin:

Sticky Radio Player

Plugin Slug:
lbg-audio5-html5-shoutcast_sticky

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-31426


The vulnerability has not been patched. You should deactivate the plugin.

SHOUT

Plugin:

SHOUT

Plugin Slug:
lbg-audio8-html5-radio_ads

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-31925


The vulnerability has not been patched. You should deactivate the plugin.

WP Lead Capturing Pages

Plugin:

WP Lead Capturing Pages

Plugin Slug:
leadcapture

Vulnerability:
SQL Injection

Patched in Version:
No Fix

Severity Score:
Critical

CVE:

2025-31424


The vulnerability has not been patched. You should deactivate the plugin.

MapSVG

Plugin:

MapSVG

Plugin Slug:
mapsvg

Vulnerability:
Privilege Escalation

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-47561


The vulnerability has not been patched. You should deactivate the plugin.

Mediabay – WordPress Media Library Folders

Plugin:

Mediabay – WordPress Media Library Folders

Plugin Slug:
mediabay

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-28948


The vulnerability has not been patched. You should deactivate the plugin.

No Spam At All

Plugin:

No Spam At All

Plugin Slug:
no-spam-at-all

Vulnerability:
Broken Access Control

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-24778


The vulnerability has not been patched. You should deactivate the plugin.

Paged Gallery

Plugin:

Paged Gallery

Plugin Slug:
paged-gallery

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-5686


The vulnerability has not been patched. You should deactivate the plugin.

Payment QR WooCommerce

Plugin:

Payment QR WooCommerce

Plugin Slug:
payment-qr-woo

Vulnerability:
Broken Access Control

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-31000


The vulnerability has not been patched. You should deactivate the plugin.

Personal Favicon

Plugin:

Personal Favicon

Plugin Slug:
personal-favicon

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-28964


The vulnerability has not been patched. You should deactivate the plugin.

Post Author

Plugin:

Post Author

Plugin Slug:
post-author

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-28950


The vulnerability has not been patched. You should deactivate the plugin.

Post Custom Templates Lite

Plugin:

Post Custom Templates Lite

Plugin Slug:
post-custom-templates-lite

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-30942


The vulnerability has not been patched. You should deactivate the plugin.

Powie’s Uptime Robot

Plugin:

Powie’s Uptime Robot

Plugin Slug:
powies-uptime-robot

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-30638


The vulnerability has not been patched. You should deactivate the plugin.

Recent Posts Slider Responsive

Plugin:

Recent Posts Slider Responsive

Plugin Slug:
recent-posts-slider-responsive

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-28966


The vulnerability has not been patched. You should deactivate the plugin.

Responsive Flipbooks

Plugin:

Responsive Flipbooks

Plugin Slug:
responsive-flipbooks

Vulnerability:
Broken Access Control

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-24776


The vulnerability has not been patched. You should deactivate the plugin.

Revolution Video Player

Plugin:

Revolution Video Player

Plugin Slug:
revolution_video_player

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-31058


The vulnerability has not been patched. You should deactivate the plugin.

Runners Log

Plugin:

Runners Log

Plugin Slug:
runners-log

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-5541


The vulnerability has not been patched. You should deactivate the plugin.

Seofy Core

Plugin:

Seofy Core

Plugin Slug:
seofy-core

Vulnerability:
Local File Inclusion

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-39473


The vulnerability has not been patched. You should deactivate the plugin.

Simple Google Static Map

Plugin:

Simple Google Static Map

Plugin Slug:
simple-google-static-map

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-27334


The vulnerability has not been patched. You should deactivate the plugin.

Simple Nested Menu

Plugin:

Simple Nested Menu

Plugin Slug:
simple-nested-menu

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-49442


The vulnerability has not been patched. You should deactivate the plugin.

SocialMark

Plugin:

SocialMark

Plugin Slug:
socialmark

Vulnerability:
Server Side Request Forgery (SSRF)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-29008


The vulnerability has not been patched. You should deactivate the plugin.

StageShow

Plugin:

StageShow

Plugin Slug:
stageshow

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-5703


The vulnerability has not been patched. You should deactivate the plugin.

Motors – Events

Plugin:

Motors – Events

Plugin Slug:
stm-motors-events

Vulnerability:
Local File Inclusion

Patched in Version:
No Fix

Severity Score:
Critical

CVE:

2025-47586


The vulnerability has not been patched. You should deactivate the plugin.

Stop Spammers

Plugin:

Stop Spammers

Plugin Slug:
stop-spammer-registrations-plugin

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-2935


The vulnerability has not been patched. You should deactivate the plugin.

The Holiday Calendar

Plugin:

The Holiday Calendar

Plugin Slug:
the-holiday-calendar

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-29003


The vulnerability has not been patched. You should deactivate the plugin.

Universal Video Player

Plugin:

Universal Video Player

Plugin Slug:
universal_video_player

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-31917


The vulnerability has not been patched. You should deactivate the plugin.

Video Embeds

Plugin:

Video Embeds

Plugin Slug:
video-embeds

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-49429


The vulnerability has not been patched. You should deactivate the plugin.

Direct Checkout for WooCommerce Lite

Plugin:

Direct Checkout for WooCommerce Lite

Plugin Slug:
woo-direct-checkout-lite

Vulnerability:
Broken Access Control

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-29006


The vulnerability has not been patched. You should deactivate the plugin.

WooCommerce Photo Reviews – Review Reminders – Review for Discounts

Plugin:

WooCommerce Photo Reviews – Review Reminders – Review for Discounts

Plugin Slug:
woocommerce-photo-reviews

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-47570


The vulnerability has not been patched. You should deactivate the plugin.

WooCommerce Ultimate Gift Card – Create, Sell and Manage Gift Cards with Customized Email Templates

Plugin:

WooCommerce Ultimate Gift Card – Create, Sell and Manage Gift Cards with Customized Email Templates

Plugin Slug:
woocommerce-ultimate-gift-card

Vulnerability:
SQL Injection

Patched in Version:
No Fix

Severity Score:
Critical

CVE:

2025-47569


The vulnerability has not been patched. You should deactivate the plugin.

WooBeWoo Product Filter Pro

Plugin:

WooBeWoo Product Filter Pro

Plugin Slug:
woofilter-pro

Vulnerability:
SQL Injection

Patched in Version:
No Fix

Severity Score:
Critical

CVE:

2025-39496


The vulnerability has not been patched. You should deactivate the plugin.

Wp Easy Allopass

Plugin:

Wp Easy Allopass

Plugin Slug:
wordpress-easy-allopass

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-49435


The vulnerability has not been patched. You should deactivate the plugin.

WP-Addpub

Plugin:

WP-Addpub

Plugin Slug:
wp-addpub

Vulnerability:
SQL Injection

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-5563


The vulnerability has not been patched. You should deactivate the plugin.

WP Biographia

Plugin:

WP Biographia

Plugin Slug:
wp-biographia

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-30928


The vulnerability has not been patched. You should deactivate the plugin.

WP Email Debug

Plugin:

WP Email Debug

Plugin Slug:
wp-email-debug

Vulnerability:
Privilege Escalation

Patched in Version:
No Fix

Severity Score:
Critical

CVE:

2025-5486


The vulnerability has not been patched. You should deactivate the plugin.

WP Featured Content Slider

Plugin:

WP Featured Content Slider

Plugin Slug:
wp-featured-content-slider

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-30634


The vulnerability has not been patched. You should deactivate the plugin.

Freemind Viewer

Plugin:

Freemind Viewer

Plugin Slug:
wp-freemind

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-5536


The vulnerability has not been patched. You should deactivate the plugin.

WP Mail Options

Plugin:

WP Mail Options

Plugin Slug:
wp-mail-options

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-28981


The vulnerability has not been patched. You should deactivate the plugin.

WP Online Users Stats

Plugin:

WP Online Users Stats

Plugin Slug:
wp-online-users-stats

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-4966


The vulnerability has not been patched. You should deactivate the plugin.

WP-Recall

Plugin:

WP-Recall

Plugin Slug:
wp-recall

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-30981


The vulnerability has not been patched. You should deactivate the plugin.

WP Security Master

Plugin:

WP Security Master

Plugin Slug:
wp-security-master

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-49440


The vulnerability has not been patched. You should deactivate the plugin.

WP Text Expander

Plugin:

WP Text Expander

Plugin Slug:
wp-text-expander

Vulnerability:
SQL Injection

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-49421


The vulnerability has not been patched. You should deactivate the plugin.

YouTube Simple Gallery

Plugin:

YouTube Simple Gallery

Plugin Slug:
youtube-simple-gallery

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-29011


The vulnerability has not been patched. You should deactivate the plugin.

Broken Link Checker

Plugin:

Broken Link Checker

Plugin Slug:
broken-link-checker

Installations
600,000+

Vulnerability:
Sensitive Data Exposure

Patched in Version:
2.4.5

Severity Score:
Medium

CVE:

2025-4047


The vulnerability has been patched, so you should update to version 2.4.5.

Ocean Extra

Plugin:

Ocean Extra

Plugin Slug:
ocean-extra

Installations
600,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
2.4.9

Severity Score:
Medium

CVE:

2025-49068


The vulnerability has been patched, so you should update to version 2.4.9.

WP Shortcodes Plugin � Shortcodes Ultimate

Plugin:

WP Shortcodes Plugin � Shortcodes Ultimate

Plugin Slug:
shortcodes-ultimate

Installations
500,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
7.4.0

Severity Score:
Medium

CVE:

2025-49244


The vulnerability has been patched, so you should update to version 7.4.0.

Real Cookie Banner: GDPR & ePrivacy Cookie Consent

Plugin:

Real Cookie Banner: GDPR & ePrivacy Cookie Consent

Plugin Slug:
real-cookie-banner

Installations
100,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
5.1.6

Severity Score:
Medium

CVE:

2025-1485


The vulnerability has been patched, so you should update to version 5.1.6.

Social Sharing Plugin � Sassy Social Share

Plugin:

Social Sharing Plugin � Sassy Social Share

Plugin Slug:
sassy-social-share

Installations
100,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
3.3.76

Severity Score:
High

CVE:

2025-5528


The vulnerability has been patched, so you should update to version 3.3.76.

Ninja Tables � Easy Data Table Builder

Plugin:

Ninja Tables � Easy Data Table Builder

Plugin Slug:
ninja-tables

Installations
80,000+

Vulnerability:
PHP Object Injection

Patched in Version:
5.0.19

Severity Score:
Critical

CVE:

2025-2939


The vulnerability has been patched, so you should update to version 5.0.19.

WP Table Builder � WordPress Table Plugin

Plugin:

WP Table Builder � WordPress Table Plugin

Plugin Slug:
wp-table-builder

Installations
60,000+

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
2.0.7

Severity Score:
Medium

CVE:

2025-49286


The vulnerability has been patched, so you should update to version 2.0.7.

Calculated Fields Form

Plugin:

Calculated Fields Form

Plugin Slug:
calculated-fields-form

Installations
50,000+

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
5.3.59

Severity Score:
Medium

CVE:

2025-49291


The vulnerability has been patched, so you should update to version 5.3.59.

Greenshift � animation and page builder blocks

Plugin:

Greenshift � animation and page builder blocks

Plugin Slug:
greenshift-animation-and-page-builder-blocks

Installations
50,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
11.5.7

Severity Score:
Medium

CVE:

2025-49301


The vulnerability has been patched, so you should update to version 11.5.7.

Sina Extension for Elementor (Header Builder, Footer Builter, Theme Builder, Slider, Gallery, Form, Modal, Data Table Free Elementor Widgets & Elementor Templates)

Plugin:

Sina Extension for Elementor (Header Builder, Footer Builter, Theme Builder, Slider, Gallery, Form, Modal, Data Table Free Elementor Widgets & Elementor Templates)

Plugin Slug:
sina-extension-for-elementor

Installations
50,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
3.7.0

Severity Score:
High

CVE:

2025-49262


The vulnerability has been patched, so you should update to version 3.7.0.

FancyBox for WordPress

Plugin:

FancyBox for WordPress

Plugin Slug:
fancybox-for-wordpress

Installations
40,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
3.3.6

Severity Score:
High

CVE:

2025-3662


The vulnerability has been patched, so you should update to version 3.3.6.

?????? ????? ??????? Persian WooCommerce SMS

Plugin:

?????? ????? ??????? Persian WooCommerce SMS

Plugin Slug:
persian-woocommerce-sms

Installations
40,000+

Vulnerability:
SQL Injection

Patched in Version:
7.1.0

Severity Score:
High

CVE:

2025-49315


The vulnerability has been patched, so you should update to version 7.1.0.

Simple Membership

Plugin:

Simple Membership

Plugin Slug:
simple-membership

Installations
40,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
4.6.4

Severity Score:
Medium

CVE:

2025-49333


The vulnerability has been patched, so you should update to version 4.6.4.

RTMKit Addons for Elementor

Plugin:

RTMKit Addons for Elementor

Plugin Slug:
rometheme-for-elementor

Installations
30,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
1.6.1

Severity Score:
Medium

CVE:

2025-49235


The vulnerability has been patched, so you should update to version 1.6.1.

Print Invoice & Delivery Notes for WooCommerce

Plugin:

Print Invoice & Delivery Notes for WooCommerce

Plugin Slug:
woocommerce-delivery-notes

Installations
30,000+

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
5.6.0

Severity Score:
Medium

CVE:

2025-49239


The vulnerability has been patched, so you should update to version 5.6.0.

Welcart e-Commerce

Plugin:

Welcart e-Commerce

Plugin Slug:
usc-e-shop

Installations
20,000+

Vulnerability:
Arbitrary File Deletion

Patched in Version:
2.11.14

Severity Score:
Medium

CVE:

2025-47511


The vulnerability has been patched, so you should update to version 2.11.14.

Backup and Staging by WP Time Capsule

Plugin:

Backup and Staging by WP Time Capsule

Plugin Slug:
wp-time-capsule

Installations
20,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
1.22.24

Severity Score:
High

CVE:

2025-47477


The vulnerability has been patched, so you should update to version 1.22.24.

Store Locator WordPress

Plugin:

Store Locator WordPress

Plugin Slug:
agile-store-locator

Installations
10,000+

Vulnerability:
Arbitrary File Upload

Patched in Version:
1.5.3

Severity Score:
Medium

CVE:

2025-49329


The vulnerability has been patched, so you should update to version 1.5.3.

Store Locator WordPress

Plugin:

Store Locator WordPress

Plugin Slug:
agile-store-locator

Installations
10,000+

Vulnerability:
SQL Injection

Patched in Version:
1.5.2

Severity Score:
High

CVE:

2025-49328


The vulnerability has been patched, so you should update to version 1.5.2.

Bellows Accordion Menu

Plugin:

Bellows Accordion Menu

Plugin Slug:
bellows-accordion-menu

Installations
10,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
1.4.4

Severity Score:
Medium

CVE:

2025-49242


The vulnerability has been patched, so you should update to version 1.4.4.

ShiftNav � Responsive Mobile Menu

Plugin:

ShiftNav � Responsive Mobile Menu

Plugin Slug:
shiftnav-responsive-mobile-menu

Installations
10,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
1.8.1

Severity Score:
Medium

CVE:

2025-49243


The vulnerability has been patched, so you should update to version 1.8.1.

WP Multilang � Translation and Multilingual Plugin

Plugin:

WP Multilang � Translation and Multilingual Plugin

Plugin Slug:
wp-multilang

Installations
10,000+

Vulnerability:
Local File Inclusion

Patched in Version:
2.4.19.1

Severity Score:
High

CVE:

2025-49307


The vulnerability has been patched, so you should update to version 2.4.19.1.

Ultimate Gift Cards for WooCommerce

Plugin:

Ultimate Gift Cards for WooCommerce

Plugin Slug:
woo-gift-cards-lite

Installations
7,000+

Vulnerability:
SQL Injection

Patched in Version:
3.1.5

Severity Score:
High

CVE:

2025-5103


The vulnerability has been patched, so you should update to version 3.1.5.

Password Policy Manager | Password Manager

Plugin:

Password Policy Manager | Password Manager

Plugin Slug:
password-policy-manager

Installations
5,000+

Vulnerability:
Broken Authentication

Patched in Version:
2.0.5

Severity Score:
High

CVE:

2025-31019


The vulnerability has been patched, so you should update to version 2.0.5.

WP Social Widget

Plugin:

WP Social Widget

Plugin Slug:
wp-social-widget

Installations
5,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
2.3.1

Severity Score:
Medium

CVE:

2025-49306


The vulnerability has been patched, so you should update to version 2.3.1.

Min Max Step Quantity Limits Manager for WooCommerce

Plugin:

Min Max Step Quantity Limits Manager for WooCommerce

Plugin Slug:
product-quantity-for-woocommerce

Installations
4,000+

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
5.1.1

Severity Score:
Medium

CVE:

2025-49510


The vulnerability has been patched, so you should update to version 5.1.1.

WordPress Comments Import & Export

Plugin:

WordPress Comments Import & Export

Plugin Slug:
comments-import-export-woocommerce

Installations
3,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
2.4.4

Severity Score:
Medium

CVE:

2025-3919


The vulnerability has been patched, so you should update to version 2.4.4.

The Events Calendar Countdown Addon

Plugin:

The Events Calendar Countdown Addon

Plugin Slug:
countdown-for-the-events-calendar

Installations
3,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
1.4.10

Severity Score:
Medium

CVE:

2025-49311


The vulnerability has been patched, so you should update to version 1.4.10.

Libro de Reclamaciones y Quejas

Plugin:

Libro de Reclamaciones y Quejas

Plugin Slug:
libro-de-reclamaciones-y-quejas

Installations
3,000+

Vulnerability:
SQL Injection

Patched in Version:
1.0

Severity Score:
High

CVE:

2025-30989


The vulnerability has been patched, so you should update to version 1.0.

Newsletters

Plugin:

Newsletters

Plugin Slug:
newsletters-lite

Installations
3,000+

Vulnerability:
Local File Inclusion

Patched in Version:
4.10

Severity Score:
High

CVE:

2025-4857


The vulnerability has been patched, so you should update to version 4.10.

WP Maintenance Mode & Site Under Construction

Plugin:

WP Maintenance Mode & Site Under Construction

Plugin Slug:
wp-maintenance-mode-site-under-construction

Installations
3,000+

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
4.4

Severity Score:
Medium

CVE:

2025-49284


The vulnerability has been patched, so you should update to version 4.4.

BlockStrap Page Builder � Bootstrap Blocks

Plugin:

BlockStrap Page Builder � Bootstrap Blocks

Plugin Slug:
blockstrap-page-builder-blocks

Installations
2,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
0.1.37

Severity Score:
Medium

CVE:

2025-30951


The vulnerability has been patched, so you should update to version 0.1.37.

oik

Plugin:

oik

Plugin Slug:
oik

Installations
2,000+

Vulnerability:
Broken Access Control

Patched in Version:
4.15.2

Severity Score:
Medium

CVE:

2025-49241


The vulnerability has been patched, so you should update to version 4.15.2.

Event post

Plugin:

Event post

Plugin Slug:
event-post

Installations
1,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
5.10.2

Severity Score:
Medium

CVE:

2025-49298


The vulnerability has been patched, so you should update to version 5.10.2.

WP Gravity Forms Salesforce

Plugin:

WP Gravity Forms Salesforce

Plugin Slug:
gf-salesforce-crmperks

Installations
1,000+

Vulnerability:
Open Redirection

Patched in Version:
1.4.8

Severity Score:
Medium

CVE:

2025-30953


The vulnerability has been patched, so you should update to version 1.4.8.

Market Exporter

Plugin:

Market Exporter

Plugin Slug:
market-exporter

Installations
1,000+

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
2.0.23

Severity Score:
Medium

CVE:

2025-49269


The vulnerability has been patched, so you should update to version 2.0.23.

Membership For WooCommerce

Plugin:

Membership For WooCommerce

Plugin Slug:
membership-for-woocommerce

Installations
1,000+

Vulnerability:
Broken Access Control

Patched in Version:
2.8.2

Severity Score:
High

CVE:

2025-49265


The vulnerability has been patched, so you should update to version 2.8.2.

Newspack Newsletters

Plugin:

Newspack Newsletters

Plugin Slug:
newspack-newsletters

Installations
1,000+

Vulnerability:
Open Redirection

Patched in Version:
3.14.0

Severity Score:
Medium

CVE:

2025-49325


The vulnerability has been patched, so you should update to version 3.14.0.

Product Catalog Simple

Plugin:

Product Catalog Simple

Plugin Slug:
post-type-x

Installations
1,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
1.8.2

Severity Score:
Medium

CVE:

2025-49305


The vulnerability has been patched, so you should update to version 1.8.2.

Raychat

Plugin:

Raychat

Plugin Slug:
raychat

Installations
1,000+

Vulnerability:
Broken Access Control

Patched in Version:
2.2.0

Severity Score:
Medium

CVE:

2025-49236


The vulnerability has been patched, so you should update to version 2.2.0.

Stock Locations for WooCommerce

Plugin:

Stock Locations for WooCommerce

Plugin Slug:
stock-locations-for-woocommerce

Installations
1,000+

Vulnerability:
Broken Access Control

Patched in Version:
2.8.7

Severity Score:
High

CVE:

2025-47463


The vulnerability has been patched, so you should update to version 2.8.7.

Vayu Blocks � Website Builder for the Block Editor

Plugin:

Vayu Blocks � Website Builder for the Block Editor

Plugin Slug:
vayu-blocks

Installations
1,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
1.3.2

Severity Score:
Medium

CVE:

2025-4420


The vulnerability has been patched, so you should update to version 1.3.2.

WordPress CRM Plugin � WP-CRM System

Plugin:

WordPress CRM Plugin � WP-CRM System

Plugin Slug:
wp-crm-system

Installations
1,000+

Vulnerability:
Broken Access Control

Patched in Version:
3.4.3

Severity Score:
Medium

CVE:

2025-49270


The vulnerability has been patched, so you should update to version 3.4.3.

WP Time Slots Booking Form

Plugin:

WP Time Slots Booking Form

Plugin Slug:
wp-time-slots-booking-form

Installations
1,000+

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
1.2.31

Severity Score:
Medium

CVE:

2025-49332


The vulnerability has been patched, so you should update to version 1.2.31.

WordPress Contact Forms by Cimatti

Plugin:

WordPress Contact Forms by Cimatti

Plugin Slug:
contact-forms

Installations
900+

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
1.9.9

Severity Score:
Medium

CVE:

2025-49069


The vulnerability has been patched, so you should update to version 1.9.9.

WP Gravity Forms Constant Contact Plugin

Plugin:

WP Gravity Forms Constant Contact Plugin

Plugin Slug:
gf-constant-contact

Installations
900+

Vulnerability:
Open Redirection

Patched in Version:
1.1.1

Severity Score:
Medium

CVE:

2025-30954


The vulnerability has been patched, so you should update to version 1.1.1.

PDF for WPForms + Drag and Drop Template Builder

Plugin:

PDF for WPForms + Drag and Drop Template Builder

Plugin Slug:
pdf-for-wpforms

Installations
900+

Vulnerability:
Broken Access Control

Patched in Version:
5.6.1

Severity Score:
Medium

CVE:

2025-49289


The vulnerability has been patched, so you should update to version 5.6.1.

Ultimate WP Mail

Plugin:

Ultimate WP Mail

Plugin Slug:
ultimate-wp-mail

Installations
900+

Vulnerability:
Broken Authentication

Patched in Version:
1.3.6

Severity Score:
High

CVE:

2025-49288


The vulnerability has been patched, so you should update to version 1.3.6.

FraudLabs Pro for WooCommerce

Plugin:

FraudLabs Pro for WooCommerce

Plugin Slug:
fraudlabs-pro-for-woocommerce

Installations
800+

Vulnerability:
Broken Access Control

Patched in Version:
2.22.12

Severity Score:
Medium

CVE:

2025-49320


The vulnerability has been patched, so you should update to version 2.22.12.

Booking Ultra Pro Appointments Booking Calendar Plugin

Plugin:

Booking Ultra Pro Appointments Booking Calendar Plugin

Plugin Slug:
booking-ultra-pro

Installations
700+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
1.1.21

Severity Score:
Medium

CVE:

2025-30637


The vulnerability has been patched, so you should update to version 1.1.21.

Broadstreet

Plugin:

Broadstreet

Plugin Slug:
broadstreet

Installations
700+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
1.51.8

Severity Score:
High

CVE:

2025-4652


The vulnerability has been patched, so you should update to version 1.51.8.

Frontend Dashboard

Plugin:

Frontend Dashboard

Plugin Slug:
frontend-dashboard

Installations
700+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
2.2.9

Severity Score:
Medium

CVE:

2025-49310


The vulnerability has been patched, so you should update to version 2.2.9.

WP Team � WordPress Team Member Plugin

Plugin:

WP Team � WordPress Team Member Plugin

Plugin Slug:
ht-team-member

Installations
700+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
1.1.8

Severity Score:
Medium

CVE:

2025-49309


The vulnerability has been patched, so you should update to version 1.1.8.

POEditor

Plugin:

POEditor

Plugin Slug:
poeditor

Installations
700+

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
0.9.11

Severity Score:
High

CVE:

2025-49237


The vulnerability has been patched, so you should update to version 0.9.11.

WC MyParcel Belgium

Plugin:

WC MyParcel Belgium

Plugin Slug:
wc-myparcel-belgium

Installations
700+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
4.5.6

Severity Score:
High

CVE:

2025-48279


The vulnerability has been patched, so you should update to version 4.5.6.

WP Page Loading

Plugin:

WP Page Loading

Plugin Slug:
wp-page-loading

Installations
700+

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
1.0.7

Severity Score:
Medium

CVE:

2025-49317


The vulnerability has been patched, so you should update to version 1.0.7.

WP Plugin Info Card

Plugin:

WP Plugin Info Card

Plugin Slug:
wp-plugin-info-card

Installations
700+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
5.4.0

Severity Score:
Medium

CVE:

2025-5116


The vulnerability has been patched, so you should update to version 5.4.0.

Search with Typesense

Plugin:

Search with Typesense

Plugin Slug:
search-with-typesense

Installations
600+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
2.0.11

Severity Score:
Medium

CVE:

2025-49304


The vulnerability has been patched, so you should update to version 2.0.11.

Verge3D Publishing and E-Commerce

Plugin:

Verge3D Publishing and E-Commerce

Plugin Slug:
verge3d

Installations
600+

Vulnerability:
Broken Access Control

Patched in Version:
4.9.5

Severity Score:
Medium

CVE:

2025-49268


The vulnerability has been patched, so you should update to version 4.9.5.

404 Page by SeedProd

Plugin:

404 Page by SeedProd

Plugin Slug:
404-page

Installations
500+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
1.0.2

Severity Score:
Medium

CVE:

2025-49322


The vulnerability has been patched, so you should update to version 1.0.2.

DocsPress � Online Documentation

Plugin:

DocsPress � Online Documentation

Plugin Slug:
docspress

Installations
500+

Vulnerability:
Broken Access Control

Patched in Version:
2.5.3

Severity Score:
Medium

CVE:

2025-49240


The vulnerability has been patched, so you should update to version 2.5.3.

Job Board Manager

Plugin:

Job Board Manager

Plugin Slug:
job-board-manager

Installations
500+

Vulnerability:
Broken Access Control

Patched in Version:
2.1.61

Severity Score:
Medium

CVE:

2025-49324


The vulnerability has been patched, so you should update to version 2.1.61.

WebHotelier for WordPress

Plugin:

WebHotelier for WordPress

Plugin Slug:
webhotelier

Installations
500+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
1.10.0

Severity Score:
Medium

CVE:

2025-49299


The vulnerability has been patched, so you should update to version 1.10.0.

Audio Editor & Recorder

Plugin:

Audio Editor & Recorder

Plugin Slug:
audio-editor-recorder

Installations
200+

Vulnerability:
Broken Access Control

Patched in Version:
2.2.2

Severity Score:
Medium

CVE:

2025-49509


The vulnerability has been patched, so you should update to version 2.2.2.

Knowledge Base

Plugin:

Knowledge Base

Plugin Slug:
knowledgebase

Installations
100+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
2.3.1

Severity Score:
Medium

CVE:

2025-5533


The vulnerability has been patched, so you should update to version 2.3.1.

MyStyle Custom Product Designer

Plugin:

MyStyle Custom Product Designer

Plugin Slug:
mystyle-custom-product-designer

Installations
80+

Vulnerability:
SQL Injection

Patched in Version:
3.21.2

Severity Score:
Critical

CVE:

2025-48281


The vulnerability has been patched, so you should update to version 3.21.2.

LTL Freight Quotes � Day & Ross Edition

Plugin:

LTL Freight Quotes � Day & Ross Edition

Plugin Slug:
ltl-freight-quotes-day-ross-edition

Installations
10+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
2.1.11

Severity Score:
High

CVE:

2025-5303


The vulnerability has been patched, so you should update to version 2.1.11.

Art Theme

Plugin:

Art Theme

Plugin Slug:
art-theme

Vulnerability:
Broken Access Control

Patched in Version:
3.12.3

Severity Score:
Medium

CVE:

2025-1778


The vulnerability has been patched, so you should update to version 3.12.3.

Civi Framework

Plugin:

Civi Framework

Plugin Slug:
civi-framework

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
2.1.6.4

Severity Score:
High

CVE:

2025-49511


The vulnerability has been patched, so you should update to version 2.1.6.4.

Crawlomatic Multisite Scraper Post Generator

Plugin:

Crawlomatic Multisite Scraper Post Generator

Plugin Slug:
crawlomatic-multipage-scraper-post-generator

Vulnerability:
Sensitive Data Exposure

Patched in Version:
2.6.9

Severity Score:
Medium

CVE:

2025-49294


The vulnerability has been patched, so you should update to version 2.6.9.

Crawlomatic Multisite Scraper Post Generator

Plugin:

Crawlomatic Multisite Scraper Post Generator

Plugin Slug:
crawlomatic-multipage-scraper-post-generator

Vulnerability:
Broken Access Control

Patched in Version:
2.6.9

Severity Score:
Medium

CVE:

2025-49293


The vulnerability has been patched, so you should update to version 2.6.9.

LTL Freight Quotes � Daylight Edition

Plugin:

LTL Freight Quotes � Daylight Edition

Plugin Slug:
ltl-freight-quotes-daylight-edition

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
2.2.7

Severity Score:
High

CVE:

2025-5303


The vulnerability has been patched, so you should update to version 2.2.7.

LTL Freight Quotes � Freightview Edition

Plugin:

LTL Freight Quotes � Freightview Edition

Plugin Slug:
ltl-freight-quotes-freightview-edition

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
1.0.12

Severity Score:
High

CVE:

2025-5303


The vulnerability has been patched, so you should update to version 1.0.12.

Modern Events Calendar Lite

Plugin:

Modern Events Calendar Lite

Plugin Slug:
modern-events-calendar-lite

Vulnerability:
Sensitive Data Exposure

Patched in Version:
7.22

Severity Score:
Medium

CVE:

2025-5733


The vulnerability has been patched, so you should update to version 7.22.

Nasa Core

Plugin:

Nasa Core

Plugin Slug:
nasa-core

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
6.4.1

Severity Score:
Medium

CVE:

2025-49067


The vulnerability has been patched, so you should update to version 6.4.1.

BRW

Plugin:

BRW

Plugin Slug:
ova-brw

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
1.8.7

Severity Score:
Medium

CVE:

2025-49314


The vulnerability has been patched, so you should update to version 1.8.7.

BRW

Plugin:

BRW

Plugin Slug:
ova-brw

Vulnerability:
Local File Inclusion

Patched in Version:
1.8.7

Severity Score:
High

CVE:

2025-49313


The vulnerability has been patched, so you should update to version 1.8.7.

NewsLetter

Plugin:

NewsLetter

Plugin Slug:
plugin-newsletter

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
8.8.5

Severity Score:
Medium

CVE:

2025-3581


The vulnerability has been patched, so you should update to version 8.8.5.

NewsLetter

Plugin:

NewsLetter

Plugin Slug:
plugin-newsletter

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
8.8.2

Severity Score:
Medium

CVE:

2025-3584


The vulnerability has been patched, so you should update to version 8.8.2.

Real Cookie Banner Pro

Plugin:

Real Cookie Banner Pro

Plugin Slug:
real-cookie-banner-pro

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
5.1.6

Severity Score:
Medium

CVE:

2025-1485


The vulnerability has been patched, so you should update to version 5.1.6.

Team Showcase

Plugin:

Team Showcase

Plugin Slug:
team-showcase-cm

Vulnerability:
Content Injection

Patched in Version:
25.05.13

Severity Score:
Medium

CVE:

2025-49250


The vulnerability has been patched, so you should update to version 25.05.13.

Team Showcase

Plugin:

Team Showcase

Plugin Slug:
team-showcase-cm

Vulnerability:
Broken Access Control

Patched in Version:
25.05.13

Severity Score:
Medium

CVE:

2025-49248


The vulnerability has been patched, so you should update to version 25.05.13.

Testimonials Showcase

Plugin:

Testimonials Showcase

Plugin Slug:
testimonials-showcase

Vulnerability:
Broken Access Control

Patched in Version:
1.9.18

Severity Score:
Medium

CVE:

2025-49246


The vulnerability has been patched, so you should update to version 1.9.18.

Abandoned Cart Pro for WooCommerce

Plugin:

Abandoned Cart Pro for WooCommerce

Plugin Slug:
woocommerce-abandon-cart-pro

Vulnerability:
Arbitrary File Upload

Patched in Version:
9.17.0

Severity Score:
Critical

CVE:

2025-4387


The vulnerability has been patched, so you should update to version 9.17.0.

WP User Frontend Pro

Plugin:

WP User Frontend Pro

Plugin Slug:
wp-user-frontend-pro

Vulnerability:
Arbitrary File Upload

Patched in Version:
4.1.4

Severity Score:
Critical

CVE:

2025-3054


The vulnerability has been patched, so you should update to version 4.1.4.

WP User Frontend Pro

Plugin:

WP User Frontend Pro

Plugin Slug:
wp-user-frontend-pro

Vulnerability:
Arbitrary File Deletion

Patched in Version:
4.1.4

Severity Score:
High

CVE:

2025-3055


The vulnerability has been patched, so you should update to version 4.1.4.

wpForo Advanced Attachments

Plugin:

wpForo Advanced Attachments

Plugin Slug:
wpforo-advanced-attachments

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
3.2.0

Severity Score:
High

CVE:

2025-4224


The vulnerability has been patched, so you should update to version 3.2.0.

WordPress Themes � 14 Patched / 21 Unpatched

Arlo

Theme:

Arlo

Theme Slug:
arlo

Vulnerability:
Local File Inclusion

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-39475


The vulnerability has not been patched. You should switch themes.

BodyCenter – Gym, Fitness WooCommerce WordPress Theme

Theme:

BodyCenter – Gym, Fitness WooCommerce WordPress Theme

Theme Slug:
bodycenter

Vulnerability:
Local File Inclusion

Patched in Version:
No Fix

Severity Score:
High

CVE:

2023-25999


The vulnerability has not been patched. You should switch themes.

CraftXtore

Theme:

CraftXtore

Theme Slug:
bw-craftxtore

Vulnerability:
Local File Inclusion

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-24770


The vulnerability has not been patched. You should switch themes.

Fitrush

Theme:

Fitrush

Theme Slug:
bw-fitrush

Vulnerability:
Local File Inclusion

Patched in Version:
No Fix

Severity Score:
High

CVE:

2023-26005


The vulnerability has not been patched. You should switch themes.

GiftXtore

Theme:

GiftXtore

Theme Slug:
bw-giftxtore

Vulnerability:
Local File Inclusion

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-28888


The vulnerability has not been patched. You should switch themes.

Petito

Theme:

Petito

Theme Slug:
bw-petito

Vulnerability:
Local File Inclusion

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-27362


The vulnerability has not been patched. You should switch themes.

Car Repair Services

Theme:

Car Repair Services

Theme Slug:
car-repair-services

Vulnerability:
Server Side Request Forgery (SSRF)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2025-30997


The vulnerability has not been patched. You should switch themes.

Themify Edmin

Theme:

Themify Edmin

Theme Slug:
edmin

Vulnerability:
PHP Object Injection

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-31047


The vulnerability has not been patched. You should switch themes.

FLAP – Business WordPress Theme

Theme:

FLAP – Business WordPress Theme

Theme Slug:
flap

Vulnerability:
PHP Object Injection

Patched in Version:
No Fix

Severity Score:
Critical

CVE:

2025-31396


The vulnerability has not been patched. You should switch themes.

FlatNews

Theme:

FlatNews

Theme Slug:
flatnews

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-32305


The vulnerability has not been patched. You should switch themes.

Inset

Theme:

Inset

Theme Slug:
inset

Vulnerability:
Local File Inclusion

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-26592


The vulnerability has not been patched. You should switch themes.

Krowd

Theme:

Krowd

Theme Slug:
krowd

Vulnerability:
Local File Inclusion

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-32595


The vulnerability has not been patched. You should switch themes.

PIMP – Creative MultiPurpose

Theme:

PIMP – Creative MultiPurpose

Theme Slug:
pimp

Vulnerability:
Deserialization of untrusted data

Patched in Version:
No Fix

Severity Score:
Critical

CVE:

2025-31398


The vulnerability has not been patched. You should switch themes.

PressGrid – Frontend Publish Reaction & Multimedia Theme

Theme:

PressGrid – Frontend Publish Reaction & Multimedia Theme

Theme Slug:
press-grid

Vulnerability:
Deserialization of untrusted data

Patched in Version:
No Fix

Severity Score:
Critical

CVE:

2025-31429


The vulnerability has not been patched. You should switch themes.

Revo

Theme:

Revo

Theme Slug:
revo

Vulnerability:
Local File Inclusion

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-39476


The vulnerability has not been patched. You should switch themes.

SNS Anton

Theme:

SNS Anton

Theme Slug:
snsanton

Vulnerability:
Local File Inclusion

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-28992


The vulnerability has not been patched. You should switch themes.

Avaz

Theme:

Avaz

Theme Slug:
snsavaz

Vulnerability:
Local File Inclusion

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-28944


The vulnerability has not been patched. You should switch themes.

Nitan

Theme:

Nitan

Theme Slug:
snsnitan

Vulnerability:
Local File Inclusion

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-24768


The vulnerability has not been patched. You should switch themes.

Soho Hotel

Theme:

Soho Hotel

Theme Slug:
soho-hotel

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-39539


The vulnerability has not been patched. You should switch themes.

Spare

Theme:

Spare

Theme Slug:
spare

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-31638


The vulnerability has not been patched. You should switch themes.

Valen – Sport, Fashion WooCommerce WordPress Theme

Theme:

Valen – Sport, Fashion WooCommerce WordPress Theme

Theme Slug:
valen

Vulnerability:
Local File Inclusion

Patched in Version:
No Fix

Severity Score:
High

CVE:

2025-28945


The vulnerability has not been patched. You should switch themes.

Courtney

Theme:

Courtney

Theme Slug:
courtney

Vulnerability:
Local File Inclusion

Patched in Version:
1.3.1

Severity Score:
High

CVE:

2025-48290


The vulnerability has been patched, so you should update to version 1.3.1.

CozyStay

Theme:

CozyStay

Theme Slug:
cozystay

Vulnerability:
PHP Object Injection

Patched in Version:
1.7.1

Severity Score:
Critical

CVE:

2025-49507


The vulnerability has been patched, so you should update to version 1.7.1.

GrandPrix

Theme:

GrandPrix

Theme Slug:
grandprix

Vulnerability:
Local File Inclusion

Patched in Version:
1.6.1

Severity Score:
High

CVE:

2025-49296


The vulnerability has been patched, so you should update to version 1.6.1.

Grill and Chow

Theme:

Grill and Chow

Theme Slug:
grillandchow

Vulnerability:
Local File Inclusion

Patched in Version:
1.6.1

Severity Score:
High

CVE:

2025-49297


The vulnerability has been patched, so you should update to version 1.6.1.

Lesya

Theme:

Lesya

Theme Slug:
lesya

Vulnerability:
Local File Inclusion

Patched in Version:
1.7.3

Severity Score:
High

CVE:

2025-48290


The vulnerability has been patched, so you should update to version 1.7.3.

Lettery

Theme:

Lettery

Theme Slug:
lettery

Vulnerability:
Local File Inclusion

Patched in Version:
1.1.8

Severity Score:
High

CVE:

2025-48290


The vulnerability has been patched, so you should update to version 1.1.8.

MediClinic

Theme:

MediClinic

Theme Slug:
mediclinic

Vulnerability:
Local File Inclusion

Patched in Version:
2.2

Severity Score:
High

CVE:

2025-49295


The vulnerability has been patched, so you should update to version 2.2.

Minterio

Theme:

Minterio

Theme Slug:
minterio

Vulnerability:
Local File Inclusion

Patched in Version:
1.4.1

Severity Score:
High

CVE:

2025-48290


The vulnerability has been patched, so you should update to version 1.4.1.

Mr. Murphy

Theme:

Mr. Murphy

Theme Slug:
mr-murphy

Vulnerability:
PHP Object Injection

Patched in Version:
1.2.12.1

Severity Score:
Critical

CVE:

2025-49072


The vulnerability has been patched, so you should update to version 1.2.12.1.

RealHomes

Theme:

RealHomes

Theme Slug:
realhomes

Vulnerability:
Privilege Escalation

Patched in Version:
4.4.1

Severity Score:
High

CVE:

2025-4601


The vulnerability has been patched, so you should update to version 4.4.1.

Starbelly

Theme:

Starbelly

Theme Slug:
starbelly

Vulnerability:
Local File Inclusion

Patched in Version:
1.3.7

Severity Score:
High

CVE:

2025-48290


The vulnerability has been patched, so you should update to version 1.3.7.

Sweet Dessert

Theme:

Sweet Dessert

Theme Slug:
sweet-dessert

Vulnerability:
PHP Object Injection

Patched in Version:
1.1.13

Severity Score:
Critical

CVE:

2025-49073


The vulnerability has been patched, so you should update to version 1.1.13.

TinySalt

Theme:

TinySalt

Theme Slug:
tinysalt

Vulnerability:
PHP Object Injection

Patched in Version:
3.10.0

Severity Score:
Critical

CVE:

2025-49455


The vulnerability has been patched, so you should update to version 3.10.0.

TinySalt

Theme:

TinySalt

Theme Slug:
tinysalt

Vulnerability:
Local File Inclusion

Patched in Version:
3.10.0

Severity Score:
High

CVE:

2025-49454


The vulnerability has been patched, so you should update to version 3.10.0.

Related articles

Uncategorized
How to Sell Tickets: 13 Proven Tactics Alexis
Uncategorized
WordPress Vulnerability Report � January 31, 2024 [email protected]
Uncategorized
WordPress Vulnerability Roundup: July 2019, Part 1 SolidWP Editorial Team
Uncategorized
How to Build Your Giving Tuesday Landing Page with Elementor Allie Nimmons
Uncategorized 6 min read
How to Get WooCommerce Donation Upsells Matt Cromwell
Uncategorized
Pre-Event to Post-Event Engagement Strategies Nathan B. Weller

Wait! Get exclusive hosting insights

Subscribe to our newsletter and stay ahead of the competition with expert advice from our hosting pros.

Loading form…