Wordfence Intelligence Weekly WordPress Vulnerability Report (August 18, 2025 to August 24, 2025)

by

📢 Calling all Vulnerability Researchers and Bug Bounty Hunters! 📢

🌞 Spring into Summer with Wordfence! Now through September 4, 2025, earn 2X bounty rewards for all in-scope submissions from our ‘High Threat’ list in software with fewer than 5 million active installs. Bounties up to $31,200 per vulnerability. Submit bold. Earn big!

💉 Participate in the SQLsplorer Challenge! Now through September 22, 2025, all SQL Injection vulnerabilities in software with at least 25 active installs are considered in-scope for all researchers, regardless of researcher tier AND earn a 20% bonus on all SQL Injection vulnerability submissions.

Last week, there were 133 vulnerabilities disclosed in 109 WordPress Plugins and 16 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 47 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back.

Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 28,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

Total Unpatched & Patched Vulnerabilities Last Week

Patch Status Number of Vulnerabilities
Patched 64
Unpatched 69

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating Number of Vulnerabilities
Medium Severity 97
High Severity 26
Critical Severity 10

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE Number of Vulnerabilities
Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) 46
Cross-Site Request Forgery (CSRF) 26
Missing Authorization 16
Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’) 9
Deserialization of Untrusted Data 7
Authentication Bypass Using an Alternate Path or Channel 4
Exposure of Sensitive Information to an Unauthorized Actor 4
Incorrect Privilege Assignment 4
Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) 3
Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) 3
Server-Side Request Forgery (SSRF) 3
Improper Privilege Management 2
Authorization Bypass Through User-Controlled Key 1
External Control of File Name or Path 1
Improper Authorization 1
Improper Control of Generation of Code (‘Code Injection’) 1
Insertion of Sensitive Information into Log File 1
Unrestricted Upload of File with Dangerous Type 1

Researchers That Contributed to WordPress Security Last Week

Researcher Name Number of Vulnerabilities
29
6
6
5
5
4
4
4
4
4
4
3
3

Bao
3
3
3
2
2
2
2
2
2
2
2
2
2
2
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name Software Slug
Admin Menu Groups admin-menu-groups
ads.txt Guru Connect adstxt-guru-connect
Advance Food Menu advance-food-menu
ATT YouTube Widget att-youtube
AutoWP – AI Content Writer & Rewriter autowp-ai-content-writer-rewriter
Backup Bolt backup-bolt
Better Post & Filter Widgets for Elementor better-post-filter-widgets-for-elementor
Bible SuperSearch biblesupersearch
Bravis User bravis-user
bxSlider integration for WordPress bxslider-integration
Case Theme User case-theme-user
Century ToolKit century-toolkit
Church Admin church-admin
Clickbank WordPress Plugin (Niche Storefront) clickbank-niche-storefronts
Cloudflare Image Resizing – Optimize & Accelerate Your Images cf-image-resizing
Comments Capcha Box comments-capcha-box
Contact Manager contact-manager
Cookie Warning cookie-warning
CubeWP – All-in-One Dynamic Content Framework cubewp-framework
Custom Comment customcomment
Custom Query Shortcode custom-query-shortcode
e-Boekhouden.nl e-boekhoudennl-connector
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy easy-digital-downloads
Equalize Digital Accessibility Checker – Audit Your Website for WCAG, ADA, and Section 508 Accessibility Errors accessibility-checker
Essential Doo Components for Visual Composer animated-icon-banner-for-visual-composer
Eventin – AI Powered Event Manager, Events Calendar, Booking and Tickets Plugin wp-event-solution
Flexible Map wp-flexible-map
Fluent Support – Helpdesk & Customer Support Ticket System fluent-support
FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce wp-marketing-automations
FunnelKit – Funnel Builder for WooCommerce Checkout funnel-builder
GiveWP – Donation Plugin and Fundraising Platform give
Greenshift – animation and page builder blocks greenshift-animation-and-page-builder-blocks
Hesabfa Accounting hesabfa-accounting
iFrame Block iframe-block
iframe Wrapper iframe-wrapper
JobWP – Job Board, Job Listing, Career Page and Recruitment Plugin jobwp
JS Archive List jquery-archive-list-widget
Kanpress kanpress
Kento Splash Screen kento-splash-screen
LifePress lifepress
Link View link-view
Listeo-Core – Directory Plugin by Purethemes listeo-core
Markup Markdown markup-markdown
MDTF – Meta Data and Taxonomies Filter wp-meta-data-filter-and-taxonomy-filter
Media Library Assistant media-library-assistant
Mesa Mesa Reservation Widget mesa-mesa-reservation-widget
miraculouscore miraculouscore
NEX-Forms – Ultimate Forms Plugin for WordPress nex-forms-express-wp-form-builder
Nexter Blocks – WordPress Gutenberg Blocks & 1000+ Starter Templates the-plus-addons-for-block-editor
Ni WooCommerce Customer Product Report ni-woocommerce-customer-product-report
Notice Bar notice-bar
Ogulo – 360° Tour ogulo-360-tour
Ovatheme Events ova-events
Page Transition page-transition
Popup for CF7 with Sweet Alert cf7-sweet-alert-popup
Portfolio Manager Pro – WordPress Responsive Portfolio & Gallery otw-portfolio-manager
PressApps Knowledge Base Contextual Sidebar Addon pressapps-knowledge-base
ProveSource Social Proof provesource
rajce rajce
Raptive Ads adthrive-ads
Recurring PayPal Donations recurring-donation
Redirection for Contact Form 7 wpcf7-redirect
Restore Permanently delete Post or Page Data restore-permanently-delete-post-or-page-data
Risk Free Cash On Delivery (COD) – WooCommerce risk-free-cash-on-delivery-cod-woocommerce
SensorPress sensorpress-uptime-monitoring
Sertifier Certificate & Badge Maker for WordPress – Tutor LMS sertifier-certificates-open-badges
Sessions sessions
ShortcodeHub – MultiPurpose Shortcode Builder shortcodehub
Sign-up Sheets sign-up-sheets
Silencesoft RSS Reader external-rss-reader
Simple Business Directory Pro simple-business-directory-pro
Simple Statistics for Feeds simple-feed-stats
Simpler Checkout simpler-checkout
Site Offline Or Coming Soon Or Maintenance Mode site-offline
SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels) slingblocks
Spexo Addons for Elementor – Free Elementor Addons, Widgets and Templates sastra-essential-addons-for-elementor
Statify Widget statify-widget
Super Store Finder superstorefinder-wp
Support Ticket support-ticket
TC Testimonials tc-testimonial
Templately – Elementor & Gutenberg Template Library: 5500+ Free & Pro Ready Templates And Cloud! templately
Terms of Service & Privacy Policy Generator terms-of-service-and-privacy-policy
ThemeMakers Visual Content Composer tmm_content_composer
Themify Audio Dock themify-audio-dock
Themify Builder themify-builder
Themify Icons themify-icons
tli.tl auto Twitter poster tlitl-auto-twitter-poster
Ultimate twitter profile widget ultimate-twitter-profile-widget
Varnish/Nginx Proxy Caching vcaching
Video Gallery – Vimeo and YouTube Gallery smart-grid-gallery
WC Plus wc-plus
WP Admin Theme wp-admin-theme
WP Colorbox wp-colorbox
WP Crontrol wp-crontrol
WP Fast Total Search – The Power of Indexed Search fulltext-search
WP Filter & Combine RSS Feeds wp-filter-combine-rss-feeds
WP Funnel Manager wp-funnel-manager
WP Mailgun SMTP wp-mailgun-smtp
WP Visitor Statistics (Real Time Traffic) wp-stats-manager
WP Webhooks – Automate repetitive tasks by creating powerful automation workflows directly within WordPress wp-webhooks
WPC Smart Compare for WooCommerce woo-smart-compare
WPC Smart Quick View for WooCommerce woo-smart-quick-view
WPMU Ldap Authentication wpmuldap
WPPizza – A Restaurant Plugin wppizza
Wptobe-memberships wptobe-memberships
WS Theme Addons ws-theme-addons
Яндекс.ПДС Пингер / Yandex Site search pinger yandex-pinger
多说社会化评论框 duoshuo
百度分享按钮 baidushare-wp

WordPress Themes with Reported Vulnerabilities Last Week

Software Name Software Slug
BlogMarks blogmarks
ColorMag colormag
Eximious Magazine eximious-magazine
Glamer glamer
Houzez houzez
Inspiro inspiro
JobZilla – Job Board WordPress Theme jobzilla
Kalium 3 | Creative WordPress & WooCommerce Theme kalium
kipso kipso
Kitring – A Beauty & Hair Salon WordPress Theme kitring
Magazine Elite magazine-elite
Noo JobMonster noo-jobmonster
organic-beauty organic-beauty
Real Spaces – WordPress Properties Directory Theme real-spaces
Sala – Startup & SaaS WordPress Theme sala
Spacious spacious

Vulnerability Details

Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.

Case Theme User <= 1.0.3 – Authentication Bypass via Social Login

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-5821
Patch Status
Patched
Published
Aug 22, 2025
Affected Software
Case Theme User
Researcher
More Details >

Cloudflare Image Resizing <= 1.5.6 – Missing Authentication to Unauthenticated Remote Code Execution via rest_pre_dispatch Hook

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-8723
Patch Status
Patched
Published
Aug 18, 2025
Affected Software
Cloudflare Image Resizing – Optimize & Accelerate Your Images
Researcher
More Details >

Jobmonster <= 4.7.9 – Authentication Bypass

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-54738
Patch Status
Patched
Published
Aug 21, 2025
Affected Software
Noo JobMonster
Researcher
More Details >

Miraculous Core <= 2.0.7 – Unauthenticated Privilege Escalation

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-49388
Patch Status
Patched
Published
Aug 21, 2025
Affected Software
miraculouscore
Researcher
More Details >

Portfolio Manager Pro 3.8 – Unauthenticated Arbitrary File Upload

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-49410
Patch Status
Unpatched
Published
Aug 21, 2025
Affected Software
Portfolio Manager Pro – WordPress Responsive Portfolio & Gallery
Researcher
More Details >

Real Spaces – WordPress Properties Directory Theme <= 3.6 – Unauthenticated Privilege Escalation to Administrator via ‘imic_agent_register’

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-6758
Patch Status
Patched
Published
Aug 18, 2025
Affected Software
Real Spaces – WordPress Properties Directory Theme
Researcher
More Details >

Simple Business Directory Pro < 15.6.9 – Unauthenticated Privilege Escalation

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-53580
Patch Status
Patched
Published
Aug 19, 2025
Affected Software
Simple Business Directory Pro
Researcher
More Details >

Simpler Checkout 0.7.0 – 1.1.13 – Authentication Bypass

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-7642
Patch Status
Patched
Published
Aug 22, 2025
Affected Software
Simpler Checkout
Researcher
More Details >

Support Ticket <= 1.9 – Unauthenticated Privilege Escalation

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-49422
Patch Status
Unpatched
Published
Aug 20, 2025
Affected Software
Support Ticket
Researcher
More Details >

WP Webhooks <= 3.3.5 – Unauthenticated Arbitrary File Copy

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-8895
Patch Status
Patched
Published
Aug 20, 2025
Affected Software
WP Webhooks – Automate repetitive tasks by creating powerful automation workflows directly within WordPress
Researcher
More Details >

CubeWP Framework <= 1.1.24 – Authenticated (Subscriber+) Privilege Escalation

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-54735
Patch Status
Patched
Published
Aug 19, 2025
Affected Software
CubeWP – All-in-One Dynamic Content Framework
Researcher
More Details >

Multiple Plugins By FunnelKit <= (Various Versions) – Authenticated (Contributor+) Sensitive Information Exposure to Privilege Escalation via Woofunnel Library

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-7654
Patch Status
Patched
Published
Aug 18, 2025
Affected Software
FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce
FunnelKit – Funnel Builder for WooCommerce Checkout
Researcher
More Details >

Real Spaces – WordPress Properties Directory Theme <= 3.5 – Authenticated (Subscriber+) Privilege Escalation to Administrator via ‘change_role_member’

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-8218
Patch Status
Patched
Published
Aug 18, 2025
Affected Software
Real Spaces – WordPress Properties Directory Theme
Researcher
More Details >

Redirection for Contact Form 7 <= 3.2.4 – Unauthenticated Arbitrary File Deletion

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-8141
Patch Status
Patched
Published
Aug 19, 2025
Affected Software
Redirection for Contact Form 7
Researcher
More Details >

Redirection for Contact Form 7 <= 3.2.4 – Unauthenticated PHP Object Injection

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-8145
Patch Status
Patched
Published
Aug 19, 2025
Affected Software
Redirection for Contact Form 7
Researcher
More Details >

BlogMarks <= 1.0.8 – Unauthenticated Local File Inclusion

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2025-53247
Patch Status
Unpatched
Published
Aug 21, 2025
Affected Software
BlogMarks
Researcher
More Details >

Bravis User <= 1.0.0 – Authentication Bypass to Account Takeover

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2025-5060
Patch Status
Unpatched
Published
Aug 22, 2025
Affected Software
Bravis User
Researcher
More Details >

Funnel Builder by FunnelKit <= 3.11.1 – Unauthenticated Local File Inclusion

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2025-54750
Patch Status
Patched
Published
Aug 19, 2025
Affected Software
FunnelKit – Funnel Builder for WooCommerce Checkout
Researcher
More Details >

Glamer <= 1.0.2 – Unauthenticated Local File Inclusion

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2025-53216
Patch Status
Unpatched
Published
Aug 21, 2025
Affected Software
Glamer
Researcher
More Details >

Inspiro <= 2.1.2 – Cross-Site Request Forgery to Arbitrary Plugin Installation

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2025-8592
Patch Status
Patched
Published
Aug 20, 2025
Affected Software
Inspiro
Researcher
More Details >

Kipso <= 1.3.4 – Unauthenticated Local File Inclusion

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2025-53578
Patch Status
Patched
Published
Aug 23, 2025
Affected Software
kipso
Researcher
More Details >

Kitring <= 2.8 – Unauthenticated Local File Inclusion

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2025-49426
Patch Status
Unpatched
Published
Aug 20, 2025
Affected Software
Kitring – A Beauty & Hair Salon WordPress Theme
Researcher
More Details >

Magazine <= 1.2.2 – Unauthenticated Local File Inclusion

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2025-53248
Patch Status
Unpatched
Published
Aug 21, 2025
Affected Software
Eximious Magazine
Researcher
More Details >

Magazine Elite <= 1.2.4 – Unauthenticated Local File Inclusion

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2025-53244
Patch Status
Unpatched
Published
Aug 21, 2025
Affected Software
Magazine Elite
Researcher
More Details >

Organic Beauty <= 1.4.6 – Unauthenticated PHP Object Injection

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2025-49890
Patch Status
Unpatched
Published
Aug 21, 2025
Affected Software
organic-beauty
Researcher
More Details >

Ovatheme Events <= 1.2.8 – Unauthenticated Local File Inclusion

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2025-53576
Patch Status
Patched
Published
Aug 20, 2025
Affected Software
Ovatheme Events
Researcher
More Details >

Portfolio Manager Pro 3.8 – Unauthenticated PHP Object Injection

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2025-49409
Patch Status
Unpatched
Published
Aug 21, 2025
Affected Software
Portfolio Manager Pro – WordPress Responsive Portfolio & Gallery
Researcher
More Details >

PressApps Knowledge Base Contextual Sidebar Addon <= 4.2.1 – Unauthenticated PHP Object Injection

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2025-49400
Patch Status
Unpatched
Published
Aug 21, 2025
Affected Software
PressApps Knowledge Base Contextual Sidebar Addon
Researcher
More Details >

Sala <= 1.1.6 – Unauthenticated Local File Inclusion

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2025-54709
Patch Status
Patched
Published
Aug 20, 2025
Affected Software
Sala – Startup & SaaS WordPress Theme
Researcher
More Details >

ThemeMakers Visual Content Composer <= 1.5.8 – Unauthenticated PHP Object Injection

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2025-53299
Patch Status
Unpatched
Published
Aug 19, 2025
Affected Software
ThemeMakers Visual Content Composer
Researcher
More Details >

WP Funnel Manager <= 1.4.0 – Unauthenticated PHP Object Injection

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2025-52761
Patch Status
Unpatched
Published
Aug 20, 2025
Affected Software
WP Funnel Manager
Researcher
More Details >

Wptobe-memberships <= 3.4.2 – Authenticated (Subscriber+) Arbitrary File Deletion

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2025-9048
Patch Status
Unpatched
Published
Aug 22, 2025
Affected Software
Wptobe-memberships
Researcher
More Details >

JS Archive List <= 6.1.5 – Unauthenticated SQL Injection via build_sql_where Function

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2025-7670
Patch Status
Patched
Published
Aug 18, 2025
Affected Software
JS Archive List
Researcher
More Details >

MDTF <= 1.3.3.7 – Unauthenticated SQL Injection

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2025-54707
Patch Status
Patched
Published
Aug 18, 2025
Affected Software
MDTF – Meta Data and Taxonomies Filter
Researcher
More Details >

Redirection for Contact Form 7 <= 3.2.4 – Unauthenticated PHP Object Injection via PHAR Deserialization

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2025-8289
Patch Status
Patched
Published
Aug 19, 2025
Affected Software
Redirection for Contact Form 7
Researcher
More Details >

Event Manager, Events Calendar, Booking, Registrations and Tickets – Eventin <= 4.0.37 – Unauthenticated Server-Side Request Forgery

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2025-7813
Patch Status
Patched
Published
Aug 22, 2025
Affected Software
Eventin – AI Powered Event Manager, Events Calendar, Booking and Tickets Plugin
Researcher
More Details >

Custom Query Shortcode <= 0.4.0 – Authenticated (Contributor+) Path Traversal via lens Parameter

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2025-8562
Patch Status
Patched
Published
Aug 24, 2025
Affected Software
Custom Query Shortcode
Researcher
More Details >

Listeo-Core <= 1.9.32 – Authenticated (Subscriber+) SQL Injection

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2025-49404
Patch Status
Unpatched
Published
Aug 20, 2025
Affected Software
Listeo-Core – Directory Plugin by Purethemes
Researcher
More Details >

Better Post & Filter Widgets for Elementor <= 1.5.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-48354
Patch Status
Unpatched
Published
Aug 21, 2025
Affected Software
Better Post & Filter Widgets for Elementor
Researcher
More Details >

Bible SuperSearch <= 6.0.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via selector_height Parameter

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-8064
Patch Status
Patched
Published
Aug 20, 2025
Affected Software
Bible SuperSearch
Researcher
More Details >

bxSlider integration for WordPress <= 1.7.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-48347
Patch Status
Unpatched
Published
Aug 21, 2025
Affected Software
bxSlider integration for WordPress
Researcher
More Details >

Colorbox Lightbox <= 1.1.5 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-49397
Patch Status
Patched
Published
Aug 20, 2025
Affected Software
WP Colorbox
Researcher
More Details >

Essential Doo Components for Visual Composer <= 1.9 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-49424
Patch Status
Unpatched
Published
Aug 18, 2025
Affected Software
Essential Doo Components for Visual Composer
Researcher
More Details >

Flexible Maps <= 1.18.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via Flexible Maps Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-8622
Patch Status
Patched
Published
Aug 18, 2025
Affected Software
Flexible Map
Researcher
More Details >

iFrame Block <= 0.1.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-49411
Patch Status
Unpatched
Published
Aug 19, 2025
Affected Software
iFrame Block
Researcher
More Details >

iframe Wrapper <= 0.1.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-49422
Patch Status
Unpatched
Published
Aug 18, 2025
Affected Software
iframe Wrapper
Researcher
More Details >

Jobmonster <= 4.8.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-57887
Patch Status
Patched
Published
Aug 22, 2025
Affected Software
Noo JobMonster
Researcher
More Details >

Kanpress <= 1.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-48356
Patch Status
Unpatched
Published
Aug 20, 2025
Affected Software
Kanpress
Researcher
More Details >

Markup Markdown <= 3.20.6 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-49420
Patch Status
Patched
Published
Aug 19, 2025
Affected Software
Markup Markdown
Researcher
More Details >

Nexter Blocks <= 4.5.4 – Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-8567
Patch Status
Patched
Published
Aug 18, 2025
Affected Software
Nexter Blocks – WordPress Gutenberg Blocks & 1000+ Starter Templates
Researcher
More Details >

Notice Bar <= 3.1.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-49389
Patch Status
Patched
Published
Aug 20, 2025
Affected Software
Notice Bar
Researcher
More Details >

Ogulo – 360° Tour <= 1.0.11 – Authenticated (Contributor+) Stored Cross-Site Scripting via slug Parameter

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-9131
Patch Status
Unpatched
Published
Aug 22, 2025
Affected Software
Ogulo – 360° Tour
Researcher
More Details >

rajce <= 0.4.2 – Authenticated (Contributor+) Server-Side Request Forgery

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-48364
Patch Status
Unpatched
Published
Aug 20, 2025
Affected Software
rajce
Researcher
More Details >

ShortcodeHub <= 1.7.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via author_link_target Parameter

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-7957
Patch Status
Unpatched
Published
Aug 22, 2025
Affected Software
ShortcodeHub – MultiPurpose Shortcode Builder
Researcher
More Details >

SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels) <= 1.6.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-8607
Patch Status
Patched
Published
Aug 20, 2025
Affected Software
SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels)
Researcher
More Details >

Spexo Addons for Elementor <= 1.0.23 – Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-8208
Patch Status
Patched
Published
Aug 23, 2025
Affected Software
Spexo Addons for Elementor – Free Elementor Addons, Widgets and Templates
Researcher
More Details >

Statify Widget <= 1.4.6 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-48322
Patch Status
Unpatched
Published
Aug 22, 2025
Affected Software
Statify Widget
Researcher
More Details >

TC Testimonials <= 1.1.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-49410
Patch Status
Unpatched
Published
Aug 19, 2025
Affected Software
TC Testimonials
Researcher
More Details >

Themify Icons <= 2.0.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-49395
Patch Status
Patched
Published
Aug 20, 2025
Affected Software
Themify Icons
Researcher
More Details >

Video Gallery – Vimeo and YouTube Gallery <= 1.1.7 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-48349
Patch Status
Unpatched
Published
Aug 21, 2025
Affected Software
Video Gallery – Vimeo and YouTube Gallery
Researcher
More Details >

WP Visitor Statistics (Real Time Traffic) <= 8.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-49400
Patch Status
Patched
Published
Aug 20, 2025
Affected Software
WP Visitor Statistics (Real Time Traffic)
Researcher
More Details >

WPC Smart Compare for WooCommerce <= 6.4.7 – Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-7496
Patch Status
Patched
Published
Aug 18, 2025
Affected Software
WPC Smart Compare for WooCommerce
Researcher
More Details >

WPC Smart Quick View for WooCommerce <= 4.2.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via woosq_btn Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-8618
Patch Status
Patched
Published
Aug 19, 2025
Affected Software
WPC Smart Quick View for WooCommerce
Researcher
More Details >

WS Theme Addons <= 2.0.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via ws_weather Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-8062
Patch Status
Unpatched
Published
Aug 22, 2025
Affected Software
WS Theme Addons
Researcher
More Details >

ATT YouTube Widget <= 1.0 – Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-48359
Patch Status
Unpatched
Published
Aug 20, 2025
Affected Software
ATT YouTube Widget
Researcher
More Details >

Clickbank WordPress Plugin (Niche Storefront) <= 1.3.5 – Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-48353
Patch Status
Unpatched
Published
Aug 21, 2025
Affected Software
Clickbank WordPress Plugin (Niche Storefront)
Researcher
More Details >

Comments Capcha Box <= 1.1 – Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-53226
Patch Status
Unpatched
Published
Aug 19, 2025
Affected Software
Comments Capcha Box
Researcher
More Details >

e-Boekhouden.nl <= 1.9.3 – Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-53225
Patch Status
Unpatched
Published
Aug 21, 2025
Affected Software
e-Boekhouden.nl
Researcher
More Details >

Kento Splash Screen <= 1.4 – Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-48351
Patch Status
Unpatched
Published
Aug 21, 2025
Affected Software
Kento Splash Screen
Researcher(s): Unknown
More Details >

Raptive Ads <= 3.8.0 – Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-53319
Patch Status
Patched
Published
Aug 19, 2025
Affected Software
Raptive Ads
Researcher
More Details >

Super Store Finder <= 7.6 – Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
Unknown
Patch Status
Unpatched
Published
Aug 21, 2025
Affected Software
Super Store Finder
Researcher
More Details >

WPMU Ldap Authentication <= 5.0.1 – Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-48343
Patch Status
Unpatched
Published
Aug 21, 2025
Affected Software
WPMU Ldap Authentication
Researcher
More Details >

百度分享按钮 <= 1.0.6 – Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-48320
Patch Status
Unpatched
Published
Aug 23, 2025
Affected Software
百度分享按钮
Researcher
More Details >

WP Crontrol – 1.17.0 – 1.19.1 – Authenticated (Administrator+) Blind Server-Side Request Forgery

5.9
CVSS Rating
Medium (5.9)
CVE-ID
CVE-2025-8678
Patch Status
Patched
Published
Aug 21, 2025
Affected Software
WP Crontrol
Researcher
More Details >

Admin Menu Groups <= 0.1.2 – Authenticated (Administrator+) Stored Cross-Site Scripting

5.5
CVSS Rating
Medium (5.5)
CVE-ID
CVE-2025-49035
Patch Status
Unpatched
Published
Aug 19, 2025
Affected Software
Admin Menu Groups
Researcher
More Details >

Easy Digital Downloads <= 3.5.0 – Cross-Site Request Forgery to Plugin Deactivation via edd_sendwp_disconnect and edd_sendwp_remote_install Functions

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2025-8102
Patch Status
Patched
Published
Aug 19, 2025
Affected Software
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
Researcher
More Details >

Church Admin <= 5.0.26 – Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-57896
Patch Status
Patched
Published
Aug 22, 2025
Affected Software
Church Admin
Researcher
More Details >

Hesabfa Accounting <= 2.2.4 – Unauthenticated Sensitive Information Exposure via Log File

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-48361
Patch Status
Unpatched
Published
Aug 20, 2025
Affected Software
Hesabfa Accounting
Researcher
More Details >

Houzez <= 4.1.1 – Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-49406
Patch Status
Patched
Published
Aug 20, 2025
Affected Software
Houzez
Researcher
More Details >

Jobmonster <= 4.8.0 – Unauthenticated Sensitive Information Disclosure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-57888
Patch Status
Patched
Published
Aug 22, 2025
Affected Software
Noo JobMonster
Researcher
More Details >

Kalium <= 3.18.3 – Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-53348
Patch Status
Unpatched
Published
Aug 21, 2025
Affected Software
Kalium 3 | Creative WordPress & WooCommerce Theme
Researcher
More Details >

ProveSource Social Proof <= 3.0.5 – Unauthenticated Sensitive Information Disclosure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-48355
Patch Status
Unpatched
Published
Aug 21, 2025
Affected Software
ProveSource Social Proof
Researcher
Bao
More Details >

WC Plus <= 1.2.0 – Missing Authorization to Unauthenticated Settings Manipulation

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-7821
Patch Status
Unpatched
Published
Aug 22, 2025
Affected Software
WC Plus
Researcher
More Details >

WP Mailgun SMTP <= 1.0.7 – Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-48327
Patch Status
Unpatched
Published
Aug 21, 2025
Affected Software
WP Mailgun SMTP
Researcher
More Details >

Advance Food Menu <= 1.0 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2025-48323
Patch Status
Unpatched
Published
Aug 22, 2025
Affected Software
Advance Food Menu
Researcher
More Details >

Contact Manager <= 8.6.5 – Authenticated (Administrator+) Stored Cross-Site Scripting via ‘title’

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2025-8783
Patch Status
Patched
Published
Aug 18, 2025
Affected Software
Contact Manager
Researcher
More Details >

Cookie Warning <= 1.3 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2025-49428
Patch Status
Unpatched
Published
Aug 18, 2025
Affected Software
Cookie Warning
Researcher
More Details >

Custom Comment <= 2.1.6 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2025-48365
Patch Status
Unpatched
Published
Aug 20, 2025
Affected Software
Custom Comment
Researcher
More Details >

Link View <= 0.8.0 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2025-49039
Patch Status
Unpatched
Published
Aug 19, 2025
Affected Software
Link View
Researcher
More Details >

Mesa Mesa Reservation Widget <= 1.0.0 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2025-48319
Patch Status
Unpatched
Published
Aug 23, 2025
Affected Software
Mesa Mesa Reservation Widget
Researcher
More Details >

Page Transition <= 1.3 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2025-49412
Patch Status
Unpatched
Published
Aug 19, 2025
Affected Software
Page Transition
Researcher
More Details >

Recurring PayPal Donations <= 1.8 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2025-57891
Patch Status
Patched
Published
Aug 22, 2025
Affected Software
Recurring PayPal Donations
Researcher
More Details >

Risk Free Cash On Delivery (COD) – WooCommerce <= 1.0.4 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2025-48358
Patch Status
Unpatched
Published
Aug 20, 2025
Affected Software
Risk Free Cash On Delivery (COD) – WooCommerce
Researcher
More Details >

SensorPress <= 1.0 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2025-49409
Patch Status
Unpatched
Published
Aug 19, 2025
Affected Software
SensorPress
Researcher
More Details >

Sessions <= 3.2.0 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2025-57890
Patch Status
Patched
Published
Aug 22, 2025
Affected Software
Sessions
Researcher
More Details >

Terms of Service & Privacy Policy Generator <= 1.0 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2025-49413
Patch Status
Unpatched
Published
Aug 19, 2025
Affected Software
Terms of Service & Privacy Policy Generator
Researcher
More Details >

Themify Audio Dock <= 2.0.5 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2025-49392
Patch Status
Patched
Published
Aug 20, 2025
Affected Software
Themify Audio Dock
Researcher
More Details >

tli.tl auto Twitter poster <= 3.4 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2025-48324
Patch Status
Unpatched
Published
Aug 22, 2025
Affected Software
tli.tl auto Twitter poster
Researcher
More Details >

Varnish/Nginx Proxy Caching <= 1.8.3 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2025-48360
Patch Status
Unpatched
Published
Aug 20, 2025
Affected Software
Varnish/Nginx Proxy Caching
Researcher
More Details >

Yandex Site search pinger <= 1.5 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2025-48352
Patch Status
Unpatched
Published
Aug 20, 2025
Affected Software
Яндекс.ПДС Пингер / Yandex Site search pinger
Researcher
More Details >

Accessibility Checker by Equalize Digital <= 1.30.0 – Authenticated (Contributor+) Insecure Direct Object Reference

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-57886
Patch Status
Patched
Published
Aug 22, 2025
Affected Software
Equalize Digital Accessibility Checker – Audit Your Website for WCAG, ADA, and Section 508 Accessibility Errors
Researcher
More Details >

ads.txt Guru Connect <= 1.1.1 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-49381
Patch Status
Patched
Published
Aug 20, 2025
Affected Software
ads.txt Guru Connect
Researcher
More Details >

AutoWP <= 2.2.2 – Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-48350
Patch Status
Unpatched
Published
Aug 21, 2025
Affected Software
AutoWP – AI Content Writer & Rewriter
Researcher
More Details >

Backup Bolt <= 1.4.1 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-49040
Patch Status
Unpatched
Published
Aug 19, 2025
Affected Software
Backup Bolt
Researcher
More Details >

Century ToolKit <= 1.2.1 – Cross-Site Request Forgery to Arbitrary Plugin Activation

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-48357
Patch Status
Unpatched
Published
Aug 20, 2025
Affected Software
Century ToolKit
Researcher
More Details >

ColorMag <= 4.0.19 – Missing Authorization to Authenticated (Subscriber+) ThemeGrill Demo Importer Plugin Installation

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-9202
Patch Status
Patched
Published
Aug 19, 2025
Affected Software
ColorMag
Researcher
More Details >

Cookie Warning <= 1.3 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-49426
Patch Status
Unpatched
Published
Aug 18, 2025
Affected Software
Cookie Warning
Researcher
More Details >

Fluent Support <= 1.9.1 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-57885
Patch Status
Patched
Published
Aug 22, 2025
Affected Software
Fluent Support – Helpdesk & Customer Support Ticket System
Researcher
Bao
More Details >

GiveWP – Donation Plugin and Fundraising Platform <= 4.5.0 – Missing Authorization to Donation Update

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-7221
Patch Status
Patched
Published
Aug 20, 2025
Affected Software
GiveWP – Donation Plugin and Fundraising Platform
Researcher
More Details >

Greenshift <= 12.1.1 – Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-57884
Patch Status
Patched
Published
Aug 22, 2025
Affected Software
Greenshift – animation and page builder blocks
Researcher
More Details >

Hesabfa Accounting <= 2.2.4 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-48362
Patch Status
Unpatched
Published
Aug 20, 2025
Affected Software
Hesabfa Accounting
Researcher
More Details >

JobWP <= 2.4.3 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-57895
Patch Status
Patched
Published
Aug 22, 2025
Affected Software
JobWP – Job Board, Job Listing, Career Page and Recruitment Plugin
Researcher
More Details >

JobZilla – Job Board WordPress Theme <= 2.0 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-49382
Patch Status
Patched
Published
Aug 20, 2025
Affected Software
JobZilla – Job Board WordPress Theme
Researcher
More Details >

LifePress <= 2.1.3 – Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-53337
Patch Status
Unpatched
Published
Aug 20, 2025
Affected Software
LifePress
Researcher
More Details >

Media Library Assistant <= 3.27 – Authenticated (Author+) Limited File Deletion

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-8357
Patch Status
Patched
Published
Aug 18, 2025
Affected Software
Media Library Assistant
Researcher
More Details >

NEX-Forms <= 9.1.3 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-49399
Patch Status
Patched
Published
Aug 20, 2025
Affected Software
NEX-Forms – Ultimate Forms Plugin for WordPress
Researcher
More Details >

Ni WooCommerce Customer Product Report <= 1.2.4 – Missing Authorization to Authenticated (Subscriber+) Settings Update

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-7827
Patch Status
Unpatched
Published
Aug 22, 2025
Affected Software
Ni WooCommerce Customer Product Report
Researcher
More Details >

Popup for CF7 with Sweet Alert <= 1.6.5 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-48363
Patch Status
Unpatched
Published
Aug 20, 2025
Affected Software
Popup for CF7 with Sweet Alert
Researcher
Bao
More Details >

Restore Permanently delete Post or Page Data <= 1.0 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-7839
Patch Status
Unpatched
Published
Aug 22, 2025
Affected Software
Restore Permanently delete Post or Page Data
Researcher
More Details >

Sertifier Certificate & Badge Maker for WordPress – Tutor LMS <= 1.19 – Cross-Site Request Forgery to Settings Update

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-7841
Patch Status
Patched
Published
Aug 22, 2025
Affected Software
Sertifier Certificate & Badge Maker for WordPress – Tutor LMS
Researcher
More Details >

Sign-up Sheets <= 2.3.3 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-49391
Patch Status
Patched
Published
Aug 20, 2025
Affected Software
Sign-up Sheets
Researcher
More Details >

Silencesoft RSS Reader <= 0.6 – Cross-Site Request Forgery to RSS Feed Deletion

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-7842
Patch Status
Unpatched
Published
Aug 22, 2025
Affected Software
Silencesoft RSS Reader
Researcher
More Details >

Simple Statistics for Feeds <= 20250322 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-57892
Patch Status
Patched
Published
Aug 22, 2025
Affected Software
Simple Statistics for Feeds
Researcher
More Details >

Site Offline <= 1.5.7 – Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-48348
Patch Status
Unpatched
Published
Aug 21, 2025
Affected Software
Site Offline Or Coming Soon Or Maintenance Mode
Researcher
More Details >

Spacious <= 1.9.11 – Missing Authorization to Autheticated (Subscriber+) Demo Data Import

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-9331
Patch Status
Patched
Published
Aug 21, 2025
Affected Software
Spacious
Researcher
More Details >

Templately <= 3.2.7 – Authenticated (Author+) Information Disclosure

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-49408
Patch Status
Patched
Published
Aug 20, 2025
Affected Software
Templately – Elementor & Gutenberg Template Library: 5500+ Free & Pro Ready Templates And Cloud!
Researcher
More Details >

Themify Builder <= 7.6.7 – Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-49396
Patch Status
Patched
Published
Aug 20, 2025
Affected Software
Themify Builder
Researcher
More Details >

Ultimate twitter profile widget <= 1.0 – Cross-Site Request Forgery to Stored Cross-Site Scripting

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-48321
Patch Status
Unpatched
Published
Aug 23, 2025
Affected Software
Ultimate twitter profile widget
Researcher
More Details >

WP Admin Theme <= 1.0 – Cross-Site Request Forgery to Stored Cross-Site Scripting

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-48325
Patch Status
Unpatched
Published
Aug 22, 2025
Affected Software
WP Admin Theme
Researcher
More Details >

WP Fast Total Search <= 1.79.270 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-57893
Patch Status
Patched
Published
Aug 22, 2025
Affected Software
WP Fast Total Search – The Power of Indexed Search
Researcher
More Details >

WP Filter & Combine RSS Feeds <= 0.4 – Missing Authorization to Authenticated (Contributor+) Feed Deletion

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-7828
Patch Status
Unpatched
Published
Aug 22, 2025
Affected Software
WP Filter & Combine RSS Feeds
Researcher
More Details >

WPPizza <= 3.19.8 – Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-57894
Patch Status
Patched
Published
Aug 22, 2025
Affected Software
WPPizza – A Restaurant Plugin
Researcher
More Details >

多说社会化评论框 <= 1.2 – Cross-Site Request Forgery to Settings Update

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-48318
Patch Status
Unpatched
Published
Aug 23, 2025
Affected Software
多说社会化评论框
Researcher
More Details >

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

The post Wordfence Intelligence Weekly WordPress Vulnerability Report (August 18, 2025 to August 24, 2025) appeared first on Wordfence.

Leave a Comment