WordPress Vulnerability Report � October 8, 2025

In this report, 99 vulnerabilities have been publicly disclosed. Security patches for 32 of these plugins and themes are now available. Please run these updates as soon as possible. If you’re a Solid Security Pro user, the version management tool may have already warned you and updated these plugins, depending on your settings.

Currently, 67 plugin and theme vulnerabilities remain unpatched. If you’re a Solid Security Pro user, those vulnerabilities are already protected by the Solid Security firewall. Virtual patches from Patchstack will be applied when a vulnerability is considered high or medium risk. If no patch is forthcoming from the vendor or the vulnerable software has been marked “closed” and dropped from the official WordPress repositories, you should deactivate it soon and look for alternative solutions.

WordPress Core

WordPress 6.8.3 is now available! This is a security release that features two fixes. As this is a security release, we recommend updating your sites immediately. For more information on WordPress 6.8.3, please visit the version page on the HelpHub site.

WordPress Plugins � 31 Patched / 66 Unpatched

Plugin:: The Pack Elementor addon
Plugin Slug:: the-pack-addon
Installations: 2,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-8214

Plugin:: Yoga Schedule Momoyoga
Plugin Slug:: momoyoga-integration
Installations: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-9852

Plugin:: Layers
Plugin Slug:: layers
Installations: 80+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-10130

Plugin:: Smart Docs
Plugin Slug:: smart-docs
Installations: 80+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-9333

Plugin:: Simple Multilanguage Plugin
Plugin Slug:: a-simple-multilanguage
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-9854

Plugin:: Ajax WooSearch
Plugin Slug:: ajax-woosearch
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2025-9697

Plugin:: All in One Music Player
Plugin Slug:: all-in-one-music-player
Vulnerability:: Path Traversal
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-8559

Plugin:: All Social Share Options
Plugin Slug:: all-social-share-options
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-10131

Plugin:: Eulerpool Research Systems
Plugin Slug:: alleaktien-quantitativ
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-10128

Plugin:: Any News Ticker
Plugin Slug:: any-news-ticker
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-10168

Plugin:: AP Background
Plugin Slug:: ap-background
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-10165

Plugin:: AP Background
Plugin Slug:: ap-background
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-9897

Plugin:: AP Background
Plugin Slug:: ap-background
Vulnerability:: Arbitrary File Upload
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-9561

Plugin:: Appy Pie Connect for WooCommerce
Plugin Slug:: appy-pie-connect-for-woocommerce
Vulnerability:: Privilege Escalation
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2025-9286

Plugin:: Auto Bulb Finder for WordPress
Plugin Slug:: auto-bulb-finder-for-wp-wc
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-9858

Plugin:: Backup Bolt
Plugin Slug:: backup-bolt
Vulnerability:: Arbitrary File Download
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-10306

Plugin:: Bei Fen
Plugin Slug:: bei-fen
Vulnerability:: Local File Inclusion
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-9993

Plugin:: BP Direct Menus
Plugin Slug:: bp-direct-menus
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-10189

Plugin:: Chat by Chatwee
Plugin Slug:: chatwee
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-9948

Plugin:: Comment Info Detector
Plugin Slug:: comment-info-detector
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-10311

Plugin:: ContentMX Content Publisher
Plugin Slug:: contentmx-content-publisher
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-9889

Plugin:: Copypress Rest API
Plugin Slug:: copypress-rest-api
Vulnerability:: Remote Code Execution (RCE)
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2025-8625

Plugin:: CTL Behance Importer Lite
Plugin Slug:: ctl-behance-importer-lite
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2025-9587

Plugin:: Custom Searchable Data Entry System
Plugin Slug:: custom-searchable-data-entry-system
Vulnerability:: Broken Access Control
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2020-36852

Plugin:: dbview
Plugin Slug:: dbview
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-10182

Plugin:: Easy Elementor Addons
Plugin Slug:: easy-elementor-addons
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-9045

Plugin:: Epic Bootstrap Buttons
Plugin Slug:: epic-bootstrap-buttons
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-8776

Plugin:: FancyTabs
Plugin Slug:: fancytabs
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-8560

Plugin:: Flexi � Guest Submit
Plugin Slug:: flexi
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-9129

Plugin:: GutenBee
Plugin Slug:: gutenbee
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-8566

Plugin:: Interactive Medical Drawing of Human Body
Plugin Slug:: interactive-medical-drawing-of-human-body
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-9332

Plugin:: Ird Slider
Plugin Slug:: ird-slider
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-9876

Plugin:: LockerPress
Plugin Slug:: lockerpress-wordpress-security
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-9946

Plugin:: Meks Easy Maps
Plugin Slug:: meks-easy-maps
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-9206

Plugin:: Mihdan: Elementor Yandex Maps
Plugin Slug:: mihdan-elementor-yandex-maps
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-8608

Plugin:: Mobile Site Redirect
Plugin Slug:: mobile-site-redirect
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-9884

Plugin:: MPWizard
Plugin Slug:: mpwizard
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-9885

Plugin:: My AskAI
Plugin Slug:: my-askai
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-10179

Plugin:: SiteAlert (Formerly WP Health)
Plugin Slug:: my-wp-health-check
Vulnerability:: Broken Access Control
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-10212

Plugin:: Nexa Blocks
Plugin Slug:: nexa-blocks
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-8624

Plugin:: Optimize More! � CSS
Plugin Slug:: optimize-more-css
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-9945

Plugin:: PayPal Forms
Plugin Slug:: paypal-forms
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-10309

Plugin:: planetcalc
Plugin Slug:: planetcalc
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-8777

Plugin:: Post By Email
Plugin Slug:: post-by-email
Vulnerability:: Arbitrary File Upload
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2025-9762

Plugin:: Restrict User Registration
Plugin Slug:: restrict-user-registration
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-9892

Plugin:: RestroPress
Plugin Slug:: restropress
Vulnerability:: Sensitive Data Exposure
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2025-9209

Plugin:: Notification Bar
Plugin Slug:: simple-bar
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-9895

Plugin:: Survey Anyplace
Plugin Slug:: surveyanyplace
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-10196

Plugin:: TableGen � Data Table Generator
Plugin Slug:: table-creator
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-10053

Plugin:: Tiny Bootstrap Elements Light
Plugin Slug:: tiny-bootstrap-elements-light
Vulnerability:: Local File Inclusion
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-9991

Plugin:: Ultimate Multi Design Video Carousel
Plugin Slug:: ultimate-multi-design-video-carousel
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-9372

Plugin:: Ultimate Viral Quiz
Plugin Slug:: ultimate-viral-quiz
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-10302

Plugin:: Unify
Plugin Slug:: unify
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-9130

Plugin:: Ultra Addons Lite for Elementor
Plugin Slug:: ut-elementor-addons-lite
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-9077

Plugin:: WeedMaps Menu
Plugin Slug:: weedmaps-menu-embed
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-8623

Plugin:: Big Post Shipping for WooCommerce
Plugin Slug:: woo-bigpost-shipping
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-10191

Plugin:: Woo superb slideshow transition gallery with random effect
Plugin Slug:: woo-superb-slideshow-transition-gallery-with-random-effect
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-9199

Plugin:: Wp cycle text announcement
Plugin Slug:: wp-cycle-text-announcement
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-9198

Plugin:: WP Dispatcher
Plugin Slug:: wp-dispatcher
Vulnerability:: Arbitrary File Upload
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2025-9212

Plugin:: WP Dispatcher
Plugin Slug:: wp-dispatcher
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2025-10582

Plugin:: WP Photo Effects
Plugin Slug:: wp-photo-effects
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-10192

Plugin:: WP SinoType
Plugin Slug:: wp-sinotype
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-9630

Plugin:: WordPress Schema Plugin For Divi, Gutenberg & Shortcodes
Plugin Slug:: wp-structured-data-schema
Vulnerability:: Content Injection
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-7825

Plugin:: WPRecovery
Plugin Slug:: wprecovery
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2025-10726

Plugin:: X Addons for Elementor
Plugin Slug:: x-addons-elementor
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2025-9204

Plugin:: Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App
Plugin Slug:: yournewsapp
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2025-9200

Plugin:: Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder)
Plugin Slug:: header-footer-elementor
Installations: 2,000,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.5.0
Severity Score:: Medium
CVE:: 2025-9703