Wordfence Intelligence Weekly WordPress Vulnerability Report (February 10, 2025 to February 16 2025)

by

📢 Did you know Wordfence runs a Bug Bounty Program for all WordPress plugins and themes at no cost to vendors? Researchers can earn up to $31,200 per vulnerability, for all in-scope vulnerabilities submitted to our Bug Bounty Program! Find a vulnerability, submit the details directly to us, and we handle all the rest.

Last week, there were 144 vulnerabilities disclosed in 116 WordPress Plugins and 7 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 50 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to make the internet more secure. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.

Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 22,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

New Firewall Rules Deployed Last Week

The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.

The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:

  • WAF-RULE-807 – Data redacted while we work with the vendor on a patch.
  • WAF-RULE-808 – Data redacted while we work with the vendor on a patch.
  • WAF-RULE-809 – Data redacted while we work with the vendor on a patch.
  • WAF-RULE-810 – Data redacted while we work with the vendor on a patch.

Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.

Total Unpatched & Patched Vulnerabilities Last Week

Patch Status Number of Vulnerabilities
Patched 99
Unpatched 45

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating Number of Vulnerabilities
Medium Severity 103
High Severity 30
Critical Severity 11

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE Number of Vulnerabilities
Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) 47
Cross-Site Request Forgery (CSRF) 25
Missing Authorization 24
Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) 13
Exposure of Sensitive Information to an Unauthorized Actor 5
Improper Control of Generation of Code (‘Code Injection’) 4
Unrestricted Upload of File with Dangerous Type 4
Authentication Bypass Using an Alternate Path or Channel 2
Authorization Bypass Through User-Controlled Key 2
Deserialization of Untrusted Data 2
Improper Authorization 2
Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) 2
Incorrect Privilege Assignment 2
Relative Path Traversal 2
Server-Side Request Forgery (SSRF) 2
Generation of Error Message Containing Sensitive Information 1
Improper Access Control 1
Improper Authentication 1
Improper Privilege Management 1
Insecure Storage of Sensitive Information 1
Protection Mechanism Failure 1

Researchers That Contributed to WordPress Security Last Week

Researcher Name Number of Vulnerabilities
18
10
10
7
6
6
6
6
5
5
5
4
3
3
3
3
3
2
2
2
2
2
2
2
2
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1

Gab
1
1
1
1
1
1
1

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name Software Slug
aDirectory – WordPress Directory Listing Plugin adirectory
Admire Extra admire-extra
AForms Eats aforms-eats
All-Images.ai – IA Image Bank and Custom Image creation all-images-ai
Analytify – Google Analytics Dashboard For WordPress (GA4 analytics made easy) wp-analytify
Aparat Responsive aparat-responsive
Apus Framework apus-framework
Avada (Fusion) Builder fusion-builder
BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net woo-bulk-editor
Book a Room book-a-room
Bootstrap collapse bootstrap-collapse
Brizy – Page Builder brizy
Chat Widget: Customer Support Button with SMS Call Button, Click to Chat Messenger, Live Chat Support Chat Button – Bit Assist bit-assist
CM Map Locations – Visualize and share your locations in a few clicks cm-map-locations
Content Snippet Manager content-snippet-manager
ConvertPlus convertplug
Customer Email Verification for WooCommerce emails-verification-for-woocommerce
DethemeKit for Elementor dethemekit-for-elementor
DirectoryPress Frontend directorypress-frontend
Discover the Best Woocommerce Product Brands Plugin for WordPress – Woocommerce Brands Plugin gs-woo-brands
Distance Based Shipping Calculator distance-based-shipping-calculator
DL Leadback dl-leadback
DX-auto-publish dx-auto-publish
Easy Amazon Product Information easy-amazon-product-information
Easy Booked – Appointment Booking and Scheduling Management System for WordPress easy-booked
Easy Elementor Addons easy-elementor-addons
Easy Quiz Maker n-media-wp-simple-quiz
Ebook Downloader ebook-downloader
ElementsKit Elementor addons elementskit-lite
Embed Google Map embed-google-map
Event Tickets and Registration event-tickets
Events Planner events-planner
Export All Posts, Products, Orders, Refunds & Users wp-ultimate-exporter
Filled In filled-in
Font Awesome WP font-awesome-wp
Front End Users front-end-only-users
FuseDesk fusedesk
gallery gallery
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory geodirectory
Glance That glance-that
Global Gallery – WordPress Responsive Gallery global-gallery
Global Meta Keyword & Description global-meta-keyword-and-description
Google Drive WP Media google-drive-wp-media
Houzez Property Feed houzez-property-feed
HT Mega – Absolute Addons For Elementor ht-mega-for-elementor
HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce hurrytimer
IE CSS3 Support ie-css3-support
iNET Webkit inet-webkit
JS Help Desk – The Ultimate Help Desk & Support Plugin js-support-ticket
Keep Backup Daily keep-backup-daily
Leyka leyka
Liveticker (by stklcode) stklcode-liveticker
LTL Freight Quotes – Estes Edition ltl-freight-quotes-estes-edition
LTL Freight Quotes – For Customers of FedEx Freight ltl-freight-quotes-fedex-freight-edition
LTL Freight Quotes – FreightQuote Edition ltl-freight-quotes-freightquote-edition
LTL Freight Quotes – Unishippers Edition ltl-freight-quotes-unishippers-edition
LTL Freight Quotes – Worldwide Express Edition ltl-freight-quotes-worldwide-express-edition
LTL Freight Quotes – XPO Edition ltl-freight-quotes-xpo-edition
Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin majestic-support
Media Library Folders media-library-plus
My Login Logout Plugin my-loginlogout
Naver Syndication V2 badr-naver-syndication
NGG Smart Image Search ngg-smart-image-search
Notif Bell notif-bell
Oliver POS – A WooCommerce Point of Sale (POS) oliver-pos
Page/Post Specific Social Share Buttons pagepost-specific-social-share-buttons
Pallet Packaging for WooCommerce pallet-packaging-for-woocommerce
Post Thumbs post-thumbs
Prezi Embedder prezi-embedder
Qubely – Advanced Gutenberg Blocks qubely
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings seo-by-rank-math
Read More & Accordion expand-maker
Related Posts Line-up-Exactly by Milliard related-posts-line-up-exactry-by-milliard
Responsive Plus – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme. responsive-add-ons
Return Refund and Exchange For WooCommerce – Return Management System, RMA Exchange, Wallet And Cancel Order Features woo-refund-and-exchange-lite
Rise Blocks – A Complete Gutenberg Page Builder rise-blocks
RSS Filter rss-filter
s2Member Pro s2member-pro
Security & Malware scan by CleanTalk security-malware-firewall
ShipEngine Shipping Quotes shipengine-shipping-quotes
sidebarTabs sidebartabs
Simple Documentation client-documentation
Simple Google Calendar Outlook Events Widget simple-google-icalendar-widget
Simple Responsive Menu simple-responsive-menu
Small Package Quotes – Purolator Edition small-package-quotes-purolator-edition
Small Package Quotes – UPS Edition small-package-quotes-ups-edition
Spotlight Social Feeds – Block, Shortcode, and Widget spotlight-social-photo-feeds
StaffList stafflist
Stream stream
SuperSaaS – online appointment scheduling supersaas-appointment-scheduling
Team – Team Members Showcase Plugin tlp-team
The Ultimate WordPress Toolkit – WP Extended wpextended
Timeline Block – Timeline block plugin for WordPress timeline-block-block
TinyMCE Advanced qTranslate fix editor problems tinymce-advanced-qtranslate-fix-editor-problems
TTT Crop ttt-crop
Vertex Addons for Elementor addons-for-elementor-builder
Waymark waymark
Welcart e-Commerce usc-e-shop
what3words Address Field 3-word-address-validation-field
Wibiya Toolbar wibiya
Widget Options – The WordPress Widget & Block Control Plugin widget-options
WP Abstracts wp-abstracts-manuscripts-manager
WP Activity Log wp-security-audit-log
WP Airbnb Review Slider wp-airbnb-review-slider
WP Booking Calendar booking
WP Directorybox Manager wp-directorybox-manager
WP Foodbakery wp-foodbakery
WP Ghost (Hide My WP Ghost) – Security & Firewall hide-my-wp
WP Html Page Sitemap wp-html-page-sitemap
WP Job Board Pro wp-job-board-pro
WP PHPList phplist-form-integration
WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts wedevs-project-manager
WP Table Manager wp-table-manager
WPSyncSheets Lite For WPForms – WPForms Google Spreadsheet Addon wpsyncsheets-wpforms
YouTube Gallery – YouTube Channel yottie-lite
Zox News – Professional WordPress News & Magazine Theme zox-news

WordPress Themes with Reported Vulnerabilities Last Week

Software Name Software Slug
Avada | Website Builder For WordPress & WooCommerce Avada
Campress campress
Click Mag – Viral WordPress News Magazine/Blog Theme click-mag
Listivo – Classified Ads WordPress Theme listivo
Puzzles | WP Magazine / Review with Store WordPress Theme + RTL puzzles
Real Estate 7 WordPress realestate-7
ZoxPress – The All-In-One WordPress News Theme zoxpress

Vulnerability Details

Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.

Brizy – Page Builder <= 2.6.4 – Authenticated (Contributor+) Arbitrary File Upload via storeUploads

9.9
CVSS Rating
Critical (9.9)
CVE-ID
CVE-2024-10960
Patch Status
Patched
Published
Feb 11, 2025
Affected Software
Brizy – Page Builder
Researcher
More Details >

Campress <= 1.35 – Unauthenticated Local File Inclusion

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-10763
Patch Status
Unpatched
Published
Feb 12, 2025
Affected Software
Campress
Researcher
More Details >

Oliver POS – A WooCommerce Point of Sale (POS) <= 2.4.2.3 – Sensitive Information Exposure to Privilege Escalation

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-13513
Patch Status
Patched
Published
Feb 14, 2025
Affected Software
Oliver POS – A WooCommerce Point of Sale (POS)
Researcher
More Details >

Real Estate 7 WordPress <= 3.5.1 – Unauthenticated Privilege Escalation to Administrator

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-13421
Patch Status
Patched
Published
Feb 11, 2025
Affected Software
Real Estate 7 WordPress
Researcher
More Details >

s2Member Pro <= 241216 – Unauthenticated PHP Object Injection

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-12562
Patch Status
Patched
Published
Feb 14, 2025
Affected Software
s2Member Pro
Researcher
More Details >

Security & Malware scan by CleanTalk <= 2.149 – Unauthenticated Arbitrary File Upload

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-13365
Patch Status
Patched
Published
Feb 11, 2025
Affected Software
Security & Malware scan by CleanTalk
Researcher
More Details >

WP Directorybox Manager <= 2.5 – Authentication Bypass

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-13182
Patch Status
Unpatched
Published
Feb 12, 2025
Affected Software
WP Directorybox Manager
Researcher
More Details >

WP Foodbakery <= 4.7 – Authentication Bypass in foodbakery_parse_request

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-0181
Patch Status
Unpatched
Published
Feb 10, 2025
Affected Software
WP Foodbakery
Researcher
More Details >

WP Foodbakery <= 4.7 – Unauthenticated Arbitrary File Upload

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-13011
Patch Status
Unpatched
Published
Feb 10, 2025
Affected Software
WP Foodbakery
Researcher
More Details >

WP Foodbakery <= 4.7 – Unauthenticated Privilege Escalation in foodbakery_registration_validation

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-0180
Patch Status
Unpatched
Published
Feb 10, 2025
Affected Software
WP Foodbakery
Researcher
More Details >

WP Job Board Pro <= 1.2.76 – Unauthenticated Privilege Escalation via process_register

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-12213
Patch Status
Unpatched
Published
Feb 11, 2025
Affected Software
WP Job Board Pro
Researcher
More Details >

All-Images.ai – IA Image Bank and Custom Image creation <= 1.0.4 – Authenticated (Subscriber+) Arbitrary File Upload

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-13714
Patch Status
Patched
Published
Feb 11, 2025
Affected Software
All-Images.ai – IA Image Bank and Custom Image creation
Researcher
More Details >

Apus Framework <= 2.3 – Authenticated (Subscriber+) Arbitrary Options Update in import_page_options

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-12296
Patch Status
Unpatched
Published
Feb 11, 2025
Affected Software
Apus Framework
Researcher
More Details >

Widget Options <= 4.1.0 – Authenticated (Contributor+) Remote Code Execution

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-22630
Patch Status
Patched
Published
Feb 11, 2025
Affected Software
Widget Options – The #1 WordPress Widget & Block Control Plugin
Researcher
More Details >

Zox News <= 3.17.0 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Modification

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-13643
Patch Status
Patched
Published
Feb 10, 2025
Affected Software
Zox News – Professional WordPress News & Magazine Theme
Researcher
More Details >

ZoxPress – The All-In-One WordPress News Theme <= 2.12.0 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-13653
Patch Status
Patched
Published
Feb 11, 2025
Affected Software
ZoxPress – The All-In-One WordPress News Theme
Researcher
More Details >

Click Mag – Viral WordPress News Magazine/Blog Theme <= 3.6.0 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Deletion

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2024-13656
Patch Status
Patched
Published
Feb 11, 2025
Affected Software
Click Mag – Viral WordPress News Magazine/Blog Theme
Researcher
More Details >

Popup Plugin For WordPress – ConvertPlus <= 3.5.30 – Missing Authorization to Authenticated (Subscriber+) Limited Options Update

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2024-13800
Patch Status
Patched
Published
Feb 11, 2025
Affected Software
ConvertPlus
Researcher
More Details >

Puzzles | WP Magazine / Review with Store WordPress Theme + RTL <= 4.2.4 – Unauthenticated PHP Object Injection

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2024-13770
Patch Status
Patched
Published
Feb 12, 2025
Affected Software
Puzzles | WP Magazine / Review with Store WordPress Theme + RTL
Researcher
More Details >

WP Abstracts <= 2.7.3 – Cross-Site Request Forgery to Arbitrary Account Deletion

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2024-12386
Patch Status
Patched
Published
Feb 11, 2025
Affected Software
WP Abstracts
Researcher
More Details >

ZoxPress – The All-In-One WordPress News Theme <= 2.12.0 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Deletion

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2024-13654
Patch Status
Patched
Published
Feb 11, 2025
Affected Software
ZoxPress – The All-In-One WordPress News Theme
Researcher
More Details >

Customer Email Verification for WooCommerce <= 2.9.5 – Authentication Bypass via Shortcode

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2024-13528
Patch Status
Patched
Published
Feb 11, 2025
Affected Software
Customer Email Verification for WooCommerce
Researcher
More Details >

Ebook Downloader <= 1.0 – Unauthenticated SQL Injection

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2024-13435
Patch Status
Unpatched
Published
Feb 11, 2025
Affected Software
Ebook Downloader
Researcher
More Details >

Export All Posts, Products, Orders, Refunds & Users <= 2.9.3 – Information Disclosure Through Unprotected Directory

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2024-12315
Patch Status
Patched
Published
Feb 11, 2025
Affected Software
Export All Posts, Products, Orders, Refunds & Users
Researcher
More Details >

JS Help Desk – The Ultimate Help Desk & Support Plugin <= 2.8.8 – Unauthenticated Sensitive Information Exposure Through Unprotected Directory

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2024-13606
Patch Status
Patched
Published
Feb 12, 2025
Affected Software
JS Help Desk – The Ultimate Help Desk & Support Plugin
Researcher
More Details >

LTL Freight Quotes – Worldwide Express Edition <= 5.0.20 – Unauthenticated SQL Injection

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2024-13473
Patch Status
Patched
Published
Feb 11, 2025
Affected Software
LTL Freight Quotes – Worldwide Express Edition
Researcher
More Details >

LTL Freight Quotes – Estes Edition <= 3.3.7 – Unauthenticated SQL Injection

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2024-13488
Patch Status
Patched
Published
Feb 14, 2025
Affected Software
LTL Freight Quotes – Estes Edition
Researcher
More Details >

LTL Freight Quotes – For Customers of FedEx Freight <= 3.4.1 – Unauthenticated SQL Injection

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2024-13480
Patch Status
Patched
Published
Feb 11, 2025
Affected Software
LTL Freight Quotes – For Customers of FedEx Freight
Researcher
More Details >

LTL Freight Quotes – FreightQuote Edition <= 2.3.11 – Unauthenticated SQL Injection

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2025-22290
Patch Status
Unpatched
Published
Feb 12, 2025
Affected Software
LTL Freight Quotes – FreightQuote Edition
Researcher
More Details >

LTL Freight Quotes – Unishippers Edition <= 2.5.8 – Unauthenticated SQL Injection

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2024-13477
Patch Status
Patched
Published
Feb 11, 2025
Affected Software
LTL Freight Quotes – Unishippers Edition
Researcher
More Details >

LTL Freight Quotes – XPO Edition <= 4.3.7 – Unauthenticated SQL Injection

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2024-13490
Patch Status
Patched
Published
Feb 11, 2025
Affected Software
LTL Freight Quotes – XPO Edition
Researcher
More Details >

Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin <= 1.0.5 – Unauthenticated Sensitive Information Exposure Through Unprotected Directory

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2024-13600
Patch Status
Patched
Published
Feb 11, 2025
Affected Software
Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin
Researcher
More Details >

ShipEngine Shipping Quotes <= 1.0.7 – Unauthenticated SQL Injection

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2024-13531
Patch Status
Patched
Published
Feb 11, 2025
Affected Software
ShipEngine Shipping Quotes
Researcher
More Details >

Small Package Quotes – Purolator Edition <= 3.6.4 – Unauthenticated SQL Injection

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2024-13532
Patch Status
Patched
Published
Feb 11, 2025
Affected Software
Small Package Quotes – Purolator Edition
Researcher
More Details >

Small Package Quotes – UPS Edition <= 4.5.16 – Unauthenticated SQL Injection

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2024-13475
Patch Status
Patched
Published
Feb 11, 2025
Affected Software
Small Package Quotes – UPS Edition
Researcher
More Details >

Avada Builder <= 3.11.13 – Unauthenticated Arbitrary Shortcode Execution

7.3
CVSS Rating
High (7.3)
CVE-ID
CVE-2024-13345
Patch Status
Patched
Published
Feb 12, 2025
Affected Software
Avada (Fusion) Builder
Researcher
More Details >

Avada Theme <= 7.11.13 – Unauthenticated Arbitrary Shortcode Execution

7.3
CVSS Rating
High (7.3)
CVE-ID
CVE-2024-13346
Patch Status
Patched
Published
Feb 12, 2025
Affected Software
Avada | Website Builder For WordPress & WooCommerce
Researcher
More Details >

HT Mega – Absolute Addons For Elementor <= 2.8.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2024-12599
Patch Status
Patched
Published
Feb 10, 2025
Affected Software
HT Mega – Absolute Addons For Elementor
Researcher
More Details >

Welcart e-Commerce <= 2.11.9 – Unauthenticated Stored Cross-Site Scripting via name Parameter

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2025-0511
Patch Status
Patched
Published
Feb 11, 2025
Affected Software
Welcart e-Commerce
Researcher
More Details >

WP Activity Log <= 5.2.2 – Unauthenticated Stored Cross-Site Scripting

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2025-0924
Patch Status
Patched
Published
Feb 12, 2025
Affected Software
WP Activity Log
Researcher
More Details >

WP Html Page Sitemap <= 2.2 – Cross-Site Request Forgery to Stored Cross-Site Scripting

7.1
CVSS Rating
High (7.1)
CVE-ID
CVE-2025-26549
Patch Status
Unpatched
Published
Feb 13, 2025
Affected Software
WP Html Page Sitemap
Researcher
More Details >

Bit Assist <= 1.5.2 – Authenticated (Subscriber+) SQL Injection via id Parameter

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2025-0821
Patch Status
Patched
Published
Feb 13, 2025
Affected Software
Chat Widget: Customer Support Button with SMS Call Button, Click to Chat Messenger, Live Chat Support Chat Button – Bit Assist
Researcher
More Details >

Bit Assist <= 1.5.2 – Path Traversal to Authenticated (Subscriber+) Arbitrary File Read via fileID Parameter

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2025-0822
Patch Status
Patched
Published
Feb 14, 2025
Affected Software
Chat Widget: Customer Support Button with SMS Call Button, Click to Chat Messenger, Live Chat Support Chat Button – Bit Assist
Researcher
More Details >

Customer Email Verification for WooCommerce <= 2.9.4 – Authenticated (Contributor+) Sensitive Information Exposure

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2024-13525
Patch Status
Patched
Published
Feb 14, 2025
Affected Software
Customer Email Verification for WooCommerce
Researcher
More Details >

Qubely – Advanced Gutenberg Blocks <= 1.8.12 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘align’ and ‘UniqueID’

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2024-9601
Patch Status
Patched
Published
Feb 13, 2025
Affected Software
Qubely – Advanced Gutenberg Blocks
Researcher
More Details >

WP Project Manager <= 2.6.17 – Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2024-13752
Patch Status
Patched
Published
Feb 14, 2025
Affected Software
WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts
Researcher
More Details >

WP Project Manager <= 2.6.17 – Authenticated (Subscriber+) SQL Injection via orderby Parameter

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2024-13500
Patch Status
Patched
Published
Feb 14, 2025
Affected Software
WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts
Researcher
More Details >

Admire Extra <= 1.6 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-13665
Patch Status
Patched
Published
Feb 11, 2025
Affected Software
Admire Extra
Researcher
More Details >

Aparat Responsive <= 1.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-26558
Patch Status
Unpatched
Published
Feb 13, 2025
Affected Software
Aparat Responsive
Researcher
More Details >

Brizy – Page Builder <= 2.6.8 – Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-10322
Patch Status
Patched
Published
Feb 12, 2025
Affected Software
Brizy – Page Builder
Researcher
More Details >

DethemeKit For Elementor <= 2.1.8 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-26772
Patch Status
Patched
Published
Feb 14, 2025
Affected Software
DethemeKit for Elementor
Researcher
More Details >

DethemeKit For Elementor <= 2.1.8 – Authenticated (Contributor+) Stored Cross-Site Scripting via De Gallery Widget

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-13644
Patch Status
Patched
Published
Feb 12, 2025
Affected Software
DethemeKit for Elementor
Researcher
More Details >

Discover the Best Woocommerce Product Brands Plugin for WordPress – Woocommerce Brands Plugin <= 1.3.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11746
Patch Status
Patched
Published
Feb 11, 2025
Affected Software
Discover the Best Woocommerce Product Brands Plugin for WordPress – Woocommerce Brands Plugin
Researcher
More Details >

Easy Elementor Addons <= 2.1.5 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-26761
Patch Status
Patched
Published
Feb 14, 2025
Affected Software
Easy Elementor Addons
Researcher
Gab
More Details >

Easy Quiz Maker <= 2.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-13456
Patch Status
Unpatched
Published
Feb 11, 2025
Affected Software
Easy Quiz Maker
Researcher
More Details >

ElementsKit Elementor addons <= 3.4.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via Image Accordion Widget

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-1005
Patch Status
Patched
Published
Feb 14, 2025
Affected Software
ElementsKit Elementor addons
Researcher
More Details >

Embed Google Map <= 3.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-26539
Patch Status
Unpatched
Published
Feb 13, 2025
Affected Software
Embed Google Map
Researcher
More Details >

Font Awesome WP <= 1.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-26567
Patch Status
Unpatched
Published
Feb 13, 2025
Affected Software
Font Awesome WP
Researcher
More Details >

Front End Users <= 3.2.30 – Authenticated (Contributor+) Stored Cross-Site Scripting via forgot-password Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-13563
Patch Status
Patched
Published
Feb 14, 2025
Affected Software
Front End Users
Researcher
More Details >

FuseDesk <= 6.6.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-13459
Patch Status
Patched
Published
Feb 11, 2025
Affected Software
FuseDesk
Researcher
More Details >

Gallery <= 2.2.1 – Authenticated (Author+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-26778
Patch Status
Patched
Published
Feb 14, 2025
Affected Software
gallery
Researcher
More Details >

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.97 – Authenticated (Subscriber+) Stored Cross-Site Scripting via Display_name Parameter

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-13506
Patch Status
Patched
Published
Feb 10, 2025
Affected Software
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
Researcher
More Details >

Google Drive WP Media <= 2.4.4 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-26574
Patch Status
Unpatched
Published
Feb 13, 2025
Affected Software
Google Drive WP Media
Researcher
More Details >

HurryTimer <= 2.11.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via Campaign Name

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-13735
Patch Status
Patched
Published
Feb 13, 2025
Affected Software
HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce
Researcher
More Details >

Leyka <= 3.31.8 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-26766
Patch Status
Patched
Published
Feb 14, 2025
Affected Software
Leyka
Researcher
More Details >

Liveticker (by stklcode) <= 1.2.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-13701
Patch Status
Patched
Published
Feb 11, 2025
Affected Software
Liveticker (by stklcode)
Researcher
More Details >

NGG Smart Image Search <= 3.2.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-13658
Patch Status
Patched
Published
Feb 11, 2025
Affected Software
NGG Smart Image Search
Researcher
More Details >

Prezi Embedder <= 2.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-26538
Patch Status
Unpatched
Published
Feb 13, 2025
Affected Software
Prezi Embedder
Researcher
More Details >

Puzzles <= 4.2.4 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-0837
Patch Status
Patched
Published
Feb 12, 2025
Affected Software
Puzzles | WP Magazine / Review with Store WordPress Theme + RTL
Researcher
More Details >

Puzzles | WP Magazine / Review with Store WordPress Theme + RTL <= 4.2.4 – Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-13769
Patch Status
Patched
Published
Feb 11, 2025
Affected Software
Puzzles | WP Magazine / Review with Store WordPress Theme + RTL
Researcher
More Details >

Rank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.235 – Authenticated (Contributor+) Stored Cross-Site Scripting via Rank Math API

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-13227
Patch Status
Patched
Published
Feb 12, 2025
Affected Software
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
Researcher
More Details >

Rise Blocks – A Complete Gutenberg Page Builder <= 3.6 – Authenticated (Contributor+) Stored Cross-Site Scripting via TitleTag Parameter

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-0506
Patch Status
Unpatched
Published
Feb 11, 2025
Affected Software
Rise Blocks – A Complete Gutenberg Page Builder
Researcher
More Details >

Simple Google Calendar Outlook Events Block Widget <= 2.6.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-22497
Patch Status
Unpatched
Published
Feb 11, 2025
Affected Software
Simple Google Calendar Outlook Events Widget
Researcher
More Details >

Timeline Block <= 1.1.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-26754
Patch Status
Patched
Published
Feb 14, 2025
Affected Software
Timeline Block – Timeline block plugin for WordPress
Researcher
More Details >

Vertex Addons for Elementor <= 1.2.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-26769
Patch Status
Patched
Published
Feb 14, 2025
Affected Software
Vertex Addons for Elementor
Researcher
More Details >

Waymark <= 1.5.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-26770
Patch Status
Patched
Published
Feb 14, 2025
Affected Software
Waymark
Researcher
More Details >

Bootstrap collapse <= 1.0.4 – Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-26551
Patch Status
Unpatched
Published
Feb 13, 2025
Affected Software
Bootstrap collapse
Researcher
More Details >

CM Map Locations <= 2.0.8 – Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-24758
Patch Status
Patched
Published
Feb 11, 2025
Affected Software
CM Map Locations – Visualize and share your locations in a few clicks
Researcher
More Details >

Content Snippet Manager <= 1.1.5 – Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-26759
Patch Status
Patched
Published
Feb 14, 2025
Affected Software
Content Snippet Manager
Researcher
More Details >

DL Leadback <= 1.2.1 – Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-26585
Patch Status
Unpatched
Published
Feb 14, 2025
Affected Software
DL Leadback
Researcher
More Details >

DX-auto-publish <= 1.2 – Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-26577
Patch Status
Unpatched
Published
Feb 13, 2025
Affected Software
DX-auto-publish
Researcher
More Details >

Easy Amazon Product Information <= 4.0.1 – Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-26568
Patch Status
Unpatched
Published
Feb 13, 2025
Affected Software
Easy Amazon Product Information
Researcher
More Details >

Events Planner <= 1.3.10 – Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-26586
Patch Status
Unpatched
Published
Feb 14, 2025
Affected Software
Events Planner
Researcher
More Details >

Filled In <= 1.9.1 – Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-22628
Patch Status
Unpatched
Published
Feb 11, 2025
Affected Software
Filled In
Researcher
More Details >

Glance That <= 4.9 – Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-26570
Patch Status
Unpatched
Published
Feb 13, 2025
Affected Software
Glance That
Researcher
More Details >

Global Meta Keyword & Description <= 2.3 – Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-26550
Patch Status
Unpatched
Published
Feb 13, 2025
Affected Software
Global Meta Keyword & Description
Researcher
More Details >

IE CSS3 Support <= 2.0.1 – Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-26589
Patch Status
Unpatched
Published
Feb 14, 2025
Affected Software
IE CSS3 Support
Researcher
More Details >

Listivo – Classified Ads WordPress Theme <= 2.3.67 – Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-13867
Patch Status
Patched
Published
Feb 12, 2025
Affected Software
Listivo – Classified Ads WordPress Theme
Researcher
More Details >

LTL Freight Quotes – Unishippers Edition <= 2.5.8 – Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-22284
Patch Status
Patched
Published
Feb 12, 2025
Affected Software
LTL Freight Quotes – Unishippers Edition
Researcher
More Details >

LTL Freight Quotes – Worldwide Express Edition <= 5.0.21 – Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-22286
Patch Status
Patched
Published
Feb 12, 2025
Affected Software
LTL Freight Quotes – Worldwide Express Edition
Researcher
More Details >

My Login Logout Plugin <= 2.4 – Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-26547
Patch Status
Unpatched
Published
Feb 13, 2025
Affected Software
My Login Logout Plugin
Researcher
More Details >

Naver Syndication V2 <= 0.8.3 – Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-26552
Patch Status
Unpatched
Published
Feb 13, 2025
Affected Software
Naver Syndication V2
Researcher
More Details >

Page/Post Specific Social Share Buttons <= 2.1 – Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-26580
Patch Status
Unpatched
Published
Feb 13, 2025
Affected Software
Page/Post Specific Social Share Buttons
Researcher
More Details >

Post Thumbs <= 1.5 – Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-26569
Patch Status
Unpatched
Published
Feb 13, 2025
Affected Software
Post Thumbs
Researcher
More Details >

Related Posts Line-up-Exactly by Milliard <= 0.0.22 – Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-26545
Patch Status
Unpatched
Published
Feb 13, 2025
Affected Software
Related Posts Line-up-Exactly by Milliard
Researcher
More Details >

RSS Filter <= 1.2 – Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-26562
Patch Status
Unpatched
Published
Feb 13, 2025
Affected Software
RSS Filter
Researcher
More Details >

sidebarTabs <= 3.1 – Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-26587
Patch Status
Unpatched
Published
Feb 14, 2025
Affected Software
sidebarTabs
Researcher
More Details >

Simple Documentation <= 1.2.8 – Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-26578
Patch Status
Unpatched
Published
Feb 13, 2025
Affected Software
Simple Documentation
Researcher
More Details >

Simple Responsive Menu <= 2.1 – Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-26543
Patch Status
Unpatched
Published
Feb 13, 2025
Affected Software
Simple Responsive Menu
Researcher
More Details >

StaffList <= 3.2.3 – Cross-Site Request Forgery to Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-13749
Patch Status
Patched
Published
Feb 11, 2025
Affected Software
StaffList
Researcher
More Details >

TinyMCE Advanced qTranslate fix editor problems <= 1.0.0 – Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-26582
Patch Status
Unpatched
Published
Feb 13, 2025
Affected Software
TinyMCE Advanced qTranslate fix editor problems
Researcher
More Details >

TTT Crop <= 1.0 – Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-26588
Patch Status
Unpatched
Published
Feb 14, 2025
Affected Software
TTT Crop
Researcher
More Details >

what3words Address Field <= 4.0.15 – Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-26768
Patch Status
Patched
Published
Feb 14, 2025
Affected Software
what3words Address Field
Researcher
More Details >

Wibiya Toolbar <= 2.0 – Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-26571
Patch Status
Unpatched
Published
Feb 13, 2025
Affected Software
Wibiya Toolbar
Researcher
More Details >

WP Foodbakery <= 4.7 – Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-13010
Patch Status
Unpatched
Published
Feb 10, 2025
Affected Software
WP Foodbakery
Researcher
More Details >

WP PHPList <= 1.7 – Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-26572
Patch Status
Unpatched
Published
Feb 13, 2025
Affected Software
WP PHPList
Researcher
More Details >

Return Refund and Exchange For WooCommerce <= 4.4.5 – Unauthenticated Sensitive Information Exposure Through Unprotected Directory

5.9
CVSS Rating
Medium (5.9)
CVE-ID
CVE-2024-13641
Patch Status
Patched
Published
Feb 13, 2025
Affected Software
Return Refund and Exchange For WooCommerce – Return Management System, RMA Exchange, Wallet And Cancel Order Features
Researcher
More Details >

BEAR <= 1.1.4.4 – Authenticated (Administrator+) Stored Cross-Site Scripting

5.5
CVSS Rating
Medium (5.5)
CVE-ID
CVE-2025-26775
Patch Status
Patched
Published
Feb 14, 2025
Affected Software
BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net
Researcher
More Details >

Elfsight Yottie Lite <= 1.3.3 – Authenticated (Administrator+) Stored Cross-Site Scripting

5.5
CVSS Rating
Medium (5.5)
CVE-ID
CVE-2025-26561
Patch Status
Unpatched
Published
Feb 13, 2025
Affected Software
YouTube Gallery – YouTube Channel
Researcher
More Details >

Stream <= 4.0.2 – Authenticated (Admin+) Server-Side Request Forgery

5.5
CVSS Rating
Medium (5.5)
CVE-ID
CVE-2024-13879
Patch Status
Patched
Published
Feb 14, 2025
Affected Software
Stream
Researcher
More Details >

Global Gallery – WordPress Responsive Gallery <= 9.1.5 – Authenticated (Subscriber+) Arbitrary Shortcode Execution

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-13814
Patch Status
Patched
Published
Feb 11, 2025
Affected Software
Global Gallery – WordPress Responsive Gallery
Researcher
More Details >

Responsive Plus – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme <= 3.1.4 – Authenticated (Contributor+) Blind Server-Side Request Forgery via remote_request

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-13834
Patch Status
Patched
Published
Feb 14, 2025
Affected Software
Responsive Plus – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme.
Researcher
More Details >

Return Refund and Exchange For WooCommerce <= 4.4.5 – Authenticated (Subscriber+) Insecure Direct Object Reference

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-13692
Patch Status
Patched
Published
Feb 13, 2025
Affected Software
Return Refund and Exchange For WooCommerce – Return Management System, RMA Exchange, Wallet And Cancel Order Features
Researcher
More Details >

AForms Eats <= 1.3.1 – Unauthenticated Full Path Disclosure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-13539
Patch Status
Patched
Published
Feb 11, 2025
Affected Software
AForms Eats
Researcher
More Details >

Event Tickets and Registration <= 5.19.1.1 – Missing Authorization to Ticket Deletion

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-1402
Patch Status
Patched
Published
Feb 13, 2025
Affected Software
Event Tickets and Registration
Researcher
More Details >

Hide My WP Ghost – Security & Firewall <= 5.3.02 – Unauthenticated Login Page Disclosure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-13794
Patch Status
Patched
Published
Feb 11, 2025
Affected Software
WP Ghost (Hide My WP Ghost) – Security & Firewall
Researcher
More Details >

iNET Webkit <= 1.2.2 – Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-22629
Patch Status
Patched
Published
Feb 11, 2025
Affected Software
iNET Webkit
Researcher
More Details >

LTL Freight Quotes – FreightQuote Edition <= 2.3.11 – Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-22287
Patch Status
Unpatched
Published
Feb 12, 2025
Affected Software
LTL Freight Quotes – FreightQuote Edition
Researcher
More Details >

LTL Freight Quotes – Unishippers Edition <= 2.5.8 – Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-22289
Patch Status
Patched
Published
Feb 12, 2025
Affected Software
LTL Freight Quotes – Unishippers Edition
Researcher
More Details >

LTL Freight Quotes – Worldwide Express Edition <= 5.0.20 – Missing Authorization to Unauthenticated Arbitrary Content Deletion

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-22291
Patch Status
Patched
Published
Feb 12, 2025
Affected Software
LTL Freight Quotes – Worldwide Express Edition
Researcher
More Details >

Pallet Packaging for WooCommerce <= 1.1.15 – Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-22285
Patch Status
Unpatched
Published
Feb 12, 2025
Affected Software
Pallet Packaging for WooCommerce
Researcher
More Details >

Spotlight Social Media Feeds <= 1.7.1 – Unauthenticated Sensitive Information Disclosure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-26758
Patch Status
Patched
Published
Feb 14, 2025
Affected Software
Spotlight Social Feeds – Block, Shortcode, and Widget
Researcher
More Details >

The Ultimate WordPress Toolkit – WP Extended <= 3.0.13 – Missing Authorization to Unauthenticated Post Order Manipulation

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-13554
Patch Status
Patched
Published
Feb 11, 2025
Affected Software
The Ultimate WordPress Toolkit – WP Extended
Researcher
More Details >

WP Booking Calendar <= 10.10 – Unauthenticated Post-Confirmation Booking Manipulation

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-13821
Patch Status
Patched
Published
Feb 11, 2025
Affected Software
WP Booking Calendar
Researcher
More Details >

Bit Assist <= 1.5.2 – Path Traversal to Authenticated (Administrator+) Arbitrary File Read via downloadResponseFile Function

4.9
CVSS Rating
Medium (4.9)
CVE-ID
CVE-2024-13791
Patch Status
Patched
Published
Feb 13, 2025
Affected Software
Chat Widget: Customer Support Button with SMS Call Button, Click to Chat Messenger, Live Chat Support Chat Button – Bit Assist
Researcher
More Details >

Keep Backup Daily <= 2.1.0 – Authenticated (Admin+) Arbitrary File Download

4.9
CVSS Rating
Medium (4.9)
CVE-ID
CVE-2025-26779
Patch Status
Patched
Published
Feb 14, 2025
Affected Software
Keep Backup Daily
Researcher
More Details >

SuperSaaS – online appointment scheduling <= 2.1.12 – Authenticated (Contributor+) Stored Cross-Site Scripting via after Parameter

4.9
CVSS Rating
Medium (4.9)
CVE-ID
CVE-2025-0862
Patch Status
Patched
Published
Feb 10, 2025
Affected Software
SuperSaaS – online appointment scheduling
Researcher
More Details >

WP Airbnb Review Slider <= 3.9 – Authenticated (Administrator+) SQL Injection

4.9
CVSS Rating
Medium (4.9)
CVE-ID
CVE-2025-26755
Patch Status
Patched
Published
Feb 14, 2025
Affected Software
WP Airbnb Review Slider
Researcher
More Details >

Notif Bell <= 0.9.8 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2025-22496
Patch Status
Patched
Published
Feb 11, 2025
Affected Software
Notif Bell
Researcher
More Details >

aDirectory – WordPress Directory Listing Plugin <= 2.3 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-13541
Patch Status
Patched
Published
Feb 11, 2025
Affected Software
aDirectory – WordPress Directory Listing Plugin
Researcher
More Details >

Analytify <= 5.5.0 – Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-26773
Patch Status
Patched
Published
Feb 14, 2025
Affected Software
Analytify – Google Analytics Dashboard For WordPress (GA4 analytics made easy)
Researcher
More Details >

Book a Room <= 2.9 – Cross-Site Request Forgery to Settings Update

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-13437
Patch Status
Unpatched
Published
Feb 11, 2025
Affected Software
Book a Room
Researcher
More Details >

DethemeKit For Elementor <= 2.1.8 – Authenticated (Contributor+) Protected Post Disclosure

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-0661
Patch Status
Patched
Published
Feb 12, 2025
Affected Software
DethemeKit for Elementor
Researcher
More Details >

DirectoryPress Frontend <= 2.7.9 – Cross-Site Request Forgery to Listing Status Update

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-10581
Patch Status
Patched
Published
Feb 14, 2025
Affected Software
DirectoryPress Frontend
Researcher
More Details >

Distance Based Shipping Calculator <= 2.0.22 – Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-26765
Patch Status
Patched
Published
Feb 14, 2025
Affected Software
Distance Based Shipping Calculator
Researcher
More Details >

Easy Booked – Appointment Booking and Scheduling Management System for WordPress <= 2.4.5 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-22634
Patch Status
Patched
Published
Feb 11, 2025
Affected Software
Easy Booked – Appointment Booking and Scheduling Management System for WordPress
Researcher
More Details >

Houzez Property Feed <= 2.4.21 – Cross-Site Request Forgery to Property Feed Export Deletion

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-0808
Patch Status
Patched
Published
Feb 11, 2025
Affected Software
Houzez Property Feed
Researcher
More Details >

Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin <= 1.0.5 – Authenticated (Subscriber+) Insecure Direct Object Reference

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-13601
Patch Status
Patched
Published
Feb 11, 2025
Affected Software
Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin
Researcher
More Details >

Media Library Folders <= 8.3.0 – Missing Authorization to Plugin Settings Change

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-0935
Patch Status
Patched
Published
Feb 14, 2025
Affected Software
Media Library Folders
Researcher
More Details >

Rank Math SEO <= 1.0.235 – Missing Authorization to Authenticated (Contributor+) Arbitrary Schema Deletion

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-13229
Patch Status
Patched
Published
Feb 12, 2025
Affected Software
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
Researcher
More Details >

Read More & Accordion <= 3.4.2 – Missing Authorization to Authenticated (Subscriber+) Arbitrary ‘Read More’ Post Deletion

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-13639
Patch Status
Patched
Published
Feb 12, 2025
Affected Software
Read More & Accordion
Researcher
More Details >

Team – Team Members Showcase Plugin <= 4.4.9 – Missing Authorization to Authenticated (Subscriber+) Settings Update

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-13439
Patch Status
Patched
Published
Feb 14, 2025
Affected Software
Team – Team Members Showcase Plugin
Researcher
More Details >

WP Table Manager <= 4.1.3 – Missing Authorization to Authenticated (Subscriber+) Directory Traversal to Folder/File Name Disclosure

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-13374
Patch Status
Patched
Published
Feb 11, 2025
Affected Software
WP Table Manager
Researcher
More Details >

WPSyncSheets Lite For WPForms – WPForms Google Spreadsheet Addon <= 1.6 – Missing Authorization to Authenticated (Subscriber+) Settings Reset

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-12164
Patch Status
Patched
Published
Feb 11, 2025
Affected Software
WPSyncSheets Lite For WPForms – WPForms Google Spreadsheet Addon
Researcher
More Details >

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

The post Wordfence Intelligence Weekly WordPress Vulnerability Report (February 10, 2025 to February 16 2025) appeared first on Wordfence.

Leave a Comment