Wordfence Intelligence Weekly WordPress Vulnerability Report (August 25, 2025 to August 31, 2025)

by

📢 Calling all Vulnerability Researchers and Bug Bounty Hunters! 📢

🌞 Spring into Summer with Wordfence! Now through September 4, 2025, earn 2X bounty rewards for all in-scope submissions from our ‘High Threat’ list in software with fewer than 5 million active installs. Bounties up to $31,200 per vulnerability. Submit bold. Earn big!

💉 Participate in the SQLsplorer Challenge! Now through September 22, 2025, all SQL Injection vulnerabilities in software with at least 25 active installs are considered in-scope for all researchers, regardless of researcher tier AND earn a 20% bonus on all SQL Injection vulnerability submissions.

Last week, there were 116 vulnerabilities disclosed in 102 WordPress Plugins and 13 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 50 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back.

Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 28,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

Total Unpatched & Patched Vulnerabilities Last Week

Patch Status Number of Vulnerabilities
Patched 74
Unpatched 42

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating Number of Vulnerabilities
Medium Severity 86
High Severity 28
Critical Severity 2

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE Number of Vulnerabilities
Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) 42
Cross-Site Request Forgery (CSRF) 14
Missing Authorization 13
Deserialization of Untrusted Data 8
Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’) 8
Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) 8
Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) 6
Unrestricted Upload of File with Dangerous Type 4
Exposure of Sensitive Information to an Unauthorized Actor 2
Improper Privilege Management 2
Server-Side Request Forgery (SSRF) 2
Improper Authentication 1
Improper Authorization 1
Improper Control of Generation of Code (‘Code Injection’) 1
Improper Handling of Insufficient Permissions or Privileges 1
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) 1
Incorrect Authorization 1
URL Redirection to Untrusted Site (‘Open Redirect’) 1

Researchers That Contributed to WordPress Security Last Week

Researcher Name Number of Vulnerabilities
15
8
6
5
4
4
4
3
3
3
3
3
3
3
3
3
3
2
2

Bao
2
2
2
2
2
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name Software Slug
140+ Widgets | Xpro Addons For Elementor – FREE xpro-elementor-addons
Add Code To Head add-code-to-head
AfterShip Tracking – All-In-One WooCommerce Order Tracking (Free plan available) aftership-woocommerce-tracking
Ajax Search Lite – Live Search & Filter ajax-search-lite
All Bootstrap Blocks all-bootstrap-blocks
All-in-One WP Migration and Backup all-in-one-wp-migration
Amministrazione Trasparente amministrazione-trasparente
B Slider – Responsive Image Slider b-slider
Beaver Builder – WordPress Page Builder beaver-builder-lite-version
BetPress betpress
bidorbuy Store Integrator bidorbuystoreintegrator
Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection stopbadbots
Bold Page Builder bold-page-builder
Booking Calendar booking
Booking System Trafft booking-system-trafft
Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools woocommerce-jetpack
Captcha.eu captcha-eu
Chartbeat chartbeat
Chatbox Manager wa-chatbox-manager
Customer Support Ticket System & Helpdesk Plugin for WordPress wp-ticket
Dokan Pro dokan-pro
Drag and Drop File Upload for Elementor Forms drag-and-drop-file-upload-for-elementor-forms
Dynamic AJAX Product Filters for WooCommerce dynamic-ajax-product-filters-for-woocommerce
ElementInvader Addons for Elementor elementinvader-addons-for-elementor
Employee Directory – Staff Listing & Team Directory Plugin for WordPress employee-directory
Employee Spotlight – Team Member Showcase & Meet the Team Plugin employee-spotlight
Epeken All Kurir Plugin for Woocommerce Full Version epeken-all-kurir
Event Booking Manager for WooCommerce – WpEvently mage-eventpress
Event List eventlist
Events Addon for Elementor events-addon-for-elementor
Exertio Framework exertio-framework
Feeds For TikTok – Show TikTok Videos in Grid or Feed Layout b-tiktok-feed
File Manager, Code Editor, and Backup by Managefy softdiscover-db-file-manager
Goal Tracker for Patreon goal-tracker-for-patreon
Google XML News Sitemap plugin gn-xml-sitemap
Gutenify – Visual Site Builder Blocks & Site Templates. gutenify
Houzez CRM houzez-crm
iATS Online Forms iats-online-forms
Instant Breaking News instant-breaking-news
Invisible Optin invisible-optin
JS Archive List jquery-archive-list-widget
Lazy Load for Videos lazy-load-for-videos
Link View link-view
List Subpages list-sub-pages
LWSCache lwscache
Nest Addons nest-addons
Newsletter subscription optin module newsletter-subscription-widget-for-sendblaster
NextGEN Gallery Search nextgen-gallery-search-galleries
Ocean Extra ocean-extra
OSM Map Widget for Elementor osm-map-elementor
Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE otter-blocks
Page Manager for Elementor page-manager-for-elementor
PDF for Elementor Forms + Drag And Drop Template Builder pdf-for-elementor-forms
Podlove Podcast Publisher podlove-podcasting-plugin-for-wordpress
Poll, Survey & Quiz Maker Plugin by Opinion Stage social-polls-by-opinionstage
Post Type Converter post-type-converter
PPWP – Password Protect WordPress | Most-Reviewed Password Plugin password-protect-page
Premium Age Verification / Restriction for WordPress age-restriction
Printeers Print & Ship invition-print-ship
Pro Bulk Watermark Plugin for WordPress pro-watermark
Pronamic Google Maps pronamic-google-maps
Related Posts Lite related-posts-lite
Responsive Mobile-Friendly Tooltip responsive-mobile-friendly-tooltip
Responsive YouTube Video Gallery Plugin for WordPress – YouTube Showcase youtube-showcase
RingCentral Communications Plugin – FREE rccp-free
Savyour Affiliate Partner savyour-affiliate-partner
SEO For Images seo-for-images
Simple Contact Form Plugin for WordPress – WP Easy Contact wp-easy-contact
Simple Download Monitor simple-download-monitor
Simple Page Access Restriction simple-page-access-restriction
SiteSEO – SEO Simplified siteseo
Slider Revolution revslider
Small Package Quotes – USPS Edition small-package-quotes-usps-edition
Solace Extra solace-extra
Table Editor wp-table-editor
TablePress – Tables in WordPress made easy tablepress
Theme Blvd Widget Areas theme-blvd-widget-areas
Theme Switcher Reloaded theme-switcher-reloaded
Transcoder transcoder
Tripadvisor Shortcode tripadvisor-shortcode
UiCore Elements – Free Elementor widgets and templates uicore-elements
Ultimate Tag Warrior Importer utw-importer
Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin uncanny-automator
Unlimited Elements For Elementor unlimited-elements-for-elementor
UPC/EAN/GTIN Code Generator upc-ean-barcode-generator
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP userswp
Vibes vibes
Video Share VOD – Turnkey Video Site Builder Script video-share-vod
WooCommerce csv import export extendons-eo-wooimport-export
WooCommerce Payment Gateway for Saferpay woocommerce-payment-gateway-for-saferpay
WordPress Automatic Plugin wp-automatic
WordPress HTML custom-html-bodyhead
WP Bulk Delete wp-bulk-delete
WP Thumbtack Review Slider wp-thumbtack-review-slider
WP ULike Pro wp-ulike-pro
WPAvatar wpavatar
Xagio SEO – AI Powered SEO xagio-seo
XM-Backup xm-backup
XmasB Quotes xmasb-quotes
Xpro Theme Builder For Elementor – FREE xpro-theme-builder
Yahoo! WebPlayer yahoo-media-player
Zephyr Project Manager zephyr-project-manager

WordPress Themes with Reported Vulnerabilities Last Week

Software Name Software Slug
AI Hub – Startup & Technology WordPress Theme aihub
ArcHub – Architecture and Interior Design WordPress Theme archub
Cars4Rent | Auto Rental & Taxi WordPress Theme + RTL cars4rent
Golo – City Travel Guide WordPress Theme golo
Houzez houzez
Hub – Responsive Multi-Purpose WordPress Theme hub
Ireca – Car Rental Boat, Bike, Vehicle, Calendar WordPress Theme ireca
Jannah – Newspaper Magazine News BuddyPress AMP jannah
Magazine Saga magazine-saga
Makeaholic – Beauty Cosmetics WordPress Theme makeaholic
Neresa – Elementor WordPress Theme neresa-wp
Nuss – Hotel Booking WordPress nuss
Pin = Pinterest Style / Personal Masonry Blog / Front-end Submission pin-wp

Vulnerability Details

Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.

Drag and Drop File Upload for Elementor Forms <= 1.5.3 – Unauthenticated Arbitrary File Upload

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-49387
Patch Status
Patched
Published
Aug 26, 2025
Affected Software
Drag and Drop File Upload for Elementor Forms
Researcher
More Details >

RingCentral Communications 1.5 – 1.6.8 – Missing Server‑Side Verification to Authentication Bypass via ringcentral_admin_login_2fa_verify Function

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-7955
Patch Status
Patched
Published
Aug 27, 2025
Affected Software
RingCentral Communications Plugin – FREE
Researcher
More Details >

Dokan Pro <= 4.0.5 – Authenticated (Vendor+) Privilege Escalation

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-5931
Patch Status
Patched
Published
Aug 25, 2025
Affected Software
Dokan Pro
Researcher
More Details >

Event List <= 2.0.4 – Authenticated (Subscriber+) Privilege Escalation

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-6366
Patch Status
Patched
Published
Aug 25, 2025
Affected Software
Event List
Researcher
More Details >

Pin WP < 7.2 – Authenticated (Subscriber+) Arbitrary File Upload

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-53251
Patch Status
Patched
Published
Aug 27, 2025
Affected Software
Pin = Pinterest Style / Personal Masonry Blog / Front-end Submission
Researcher
More Details >

Video Share VOD – Turnkey Video Site Builder Script <= 2.7.6 – Cross-Site Request Forgery to Command Injection

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-7812
Patch Status
Patched
Published
Aug 27, 2025
Affected Software
Video Share VOD – Turnkey Video Site Builder Script
Researcher
More Details >

Booster for WooCommerce <= 7.2.4 – Unauthenticated Double Extension Arbitrary File Upload

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2024-13342
Patch Status
Patched
Published
Aug 28, 2025
Affected Software
Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools
Researcher
More Details >

Cars4Rent <= 1.4.2 – Unauthenticated PHP Object Injection

8.1
CVSS Rating
High (8.1)
CVE-ID
Unknown
Patch Status
Unpatched
Published
Aug 26, 2025
Affected Software
Cars4Rent | Auto Rental & Taxi WordPress Theme + RTL
Researcher
More Details >

Employee Directory – Staff Listing & Team Directory Plugin for WordPress <= 4.5.3 – Unauthenticated PHP Object Injection

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2025-53243
Patch Status
Unpatched
Published
Aug 25, 2025
Affected Software
Employee Directory – Staff Listing & Team Directory Plugin for WordPress
Researcher
More Details >

Employee Spotlight <= 5.1.1 – Unauthenticated PHP Object Injection

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2025-53583
Patch Status
Patched
Published
Aug 25, 2025
Affected Software
Employee Spotlight – Team Member Showcase & Meet the Team Plugin
Researcher
More Details >

Gutenify <= 1.5.6 – Unauthenticated Local File Inclusion

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2025-53326
Patch Status
Unpatched
Published
Aug 26, 2025
Affected Software
Gutenify – Visual Site Builder Blocks & Site Templates.
Researcher
More Details >

Houzez <= 4.1.1 – Unauthenticated Local File Inclusion

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2025-49405
Patch Status
Patched
Published
Aug 27, 2025
Affected Software
Houzez
Researcher
More Details >

Ireca <= 1.8.5 – Unauthenticated Local File Inclusion

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2025-54716
Patch Status
Patched
Published
Aug 27, 2025
Affected Software
Ireca – Car Rental Boat, Bike, Vehicle, Calendar WordPress Theme
Researcher
More Details >

Jannah <= 7.4.1 – Unauthenticated Local File Inclusion

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2025-53334
Patch Status
Unpatched
Published
Aug 25, 2025
Affected Software
Jannah – Newspaper Magazine News BuddyPress AMP
Researcher
More Details >

Magazine Saga <= 1.2.7 – Unauthenticated Local File Inclusion

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2025-53227
Patch Status
Unpatched
Published
Aug 25, 2025
Affected Software
Magazine Saga
Researcher
More Details >

Neresa <= 1.3 – Unauthenticated Local File Inclusion

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2025-49383
Patch Status
Patched
Published
Aug 27, 2025
Affected Software
Neresa – Elementor WordPress Theme
Researcher
More Details >

Nuss <= 1.3.3 – Unauthenticated Local File Inclusion

8.1
CVSS Rating
High (8.1)
CVE-ID
Unknown
Patch Status
Unpatched
Published
Aug 25, 2025
Affected Software
Nuss – Hotel Booking WordPress
Researcher
More Details >

Poll, Survey & Quiz Maker Plugin by Opinion Stage <= 19.11.0 – Unauthenticated Local File Inclusion

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2025-53328
Patch Status
Unpatched
Published
Aug 26, 2025
Affected Software
Poll, Survey & Quiz Maker Plugin by Opinion Stage
Researcher
More Details >

UPC/EAN/GTIN Code Generator <= 2.0.2 – Authenticated (Subscriber+) Arbitrary File Deletion

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2025-53588
Patch Status
Patched
Published
Aug 25, 2025
Affected Software
UPC/EAN/GTIN Code Generator
Researcher
More Details >

WooCommerce csv import export <= 2.0.6 – Authenticated (Subscriber+) Arbitrary File Deletion

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2025-54029
Patch Status
Patched
Published
Aug 26, 2025
Affected Software
WooCommerce csv import export
Researcher
More Details >

WP Easy Contact <= 4.0.1 – Unauthenticated PHP Object Injection

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2025-53572
Patch Status
Patched
Published
Aug 25, 2025
Affected Software
Simple Contact Form Plugin for WordPress – WP Easy Contact
Researcher
More Details >

WP Ticket Customer Service Software & Support Ticket System <= 6.0.2 – Unauthenticated PHP Object Injection

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2025-53584
Patch Status
Patched
Published
Aug 25, 2025
Affected Software
Customer Support Ticket System & Helpdesk Plugin for WordPress
Researcher
More Details >

YouTube Showcase <= 3.5.1 – Unauthenticated PHP Object Injection

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2025-54731
Patch Status
Patched
Published
Aug 25, 2025
Affected Software
Responsive YouTube Video Gallery Plugin for WordPress – YouTube Showcase
Researcher
More Details >

JS Archive List <= 6.1.5 – Unauthenticated SQL Injection

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2025-54726
Patch Status
Patched
Published
Aug 27, 2025
Affected Software
JS Archive List
Researcher
Bao
More Details >

Nest Addons <= 1.6.3 – Unauthenticated SQL Injection

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2025-54720
Patch Status
Patched
Published
Aug 27, 2025
Affected Software
Nest Addons
Researcher
More Details >

Premium Age Verification / Restriction for WordPress <= 3.0.2 – Unauthenticated Arbitrary File Download

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2025-49403
Patch Status
Unpatched
Published
Aug 26, 2025
Affected Software
Premium Age Verification / Restriction for WordPress
Researcher
More Details >

Vibes <= 2.2.0 – Unauthenticated SQL Injection via `resource` Parameter

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2025-9172
Patch Status
Patched
Published
Aug 25, 2025
Affected Software
Vibes
Researcher
More Details >

WpEvently <= 4.4.8 – Authenticated (Contributor+) PHP Object Injection

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2025-54742
Patch Status
Patched
Published
Aug 27, 2025
Affected Software
Event Booking Manager for WooCommerce – WpEvently
Researcher
More Details >

Xagio SEO <= 7.1.0.5 – Unauthenticated Sensitive Information Exposure via Unprotected Back-Up Files

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2024-13807
Patch Status
Patched
Published
Aug 27, 2025
Affected Software
Xagio SEO – AI Powered SEO
Researcher
More Details >

bidorbuy Store Integrator <= 2.12.0 – Authenticated (Admin+) Remote Code Execution

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2025-48100
Patch Status
Unpatched
Published
Aug 25, 2025
Affected Software
bidorbuy Store Integrator
Researcher
More Details >

Small Package Quotes – USPS Edition <= 1.3.9 – Authenticated (Administrator+) PHP Object Injection

6.6
CVSS Rating
Medium (6.6)
CVE-ID
CVE-2025-58218
Patch Status
Patched
Published
Aug 27, 2025
Affected Software
Small Package Quotes – USPS Edition
Researcher
More Details >

Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection <= 11.58 – Insufficient Authorization to Unauthenticated Blocklist Bypass

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2025-9376
Patch Status
Patched
Published
Aug 27, 2025
Affected Software
Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection
Researcher
More Details >

Exertio Framework <= 1.3.3 – Authenticated (Subscriber+) SQL Injection

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2025-49402
Patch Status
Unpatched
Published
Aug 25, 2025
Affected Software
Exertio Framework
Researcher
More Details >

iATS Online Forms <= 1.2 – Authenticated (Contributor+) SQL Injection via order Parameter

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2025-9441
Patch Status
Unpatched
Published
Aug 28, 2025
Affected Software
iATS Online Forms
Researcher
More Details >

Simple Download Monitor <= 3.9.33 – Simple Download Monitor <= 3.9.33 – Authenticated (Contributor+) SQL Injection via order parameter in Log Export functionality

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2025-8977
Patch Status
Patched
Published
Aug 27, 2025
Affected Software
Simple Download Monitor
Researcher
More Details >

Slider Revolution <= 6.7.36 – Authenticated (Contributor+) Arbitrary File Read via ‘used_svg’ and ‘used_images’

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2025-9217
Patch Status
Patched
Published
Aug 28, 2025
Affected Software
Slider Revolution
Researcher
More Details >

Bold Page Builder <= 5.4.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-58194
Patch Status
Patched
Published
Aug 27, 2025
Affected Software
Bold Page Builder
Researcher
More Details >

Booking Calendar <= 10.14.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-9346
Patch Status
Patched
Published
Aug 27, 2025
Affected Software
Booking Calendar
Researcher
More Details >

Booking System Trafft <= 1.0.14 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-58213
Patch Status
Patched
Published
Aug 27, 2025
Affected Software
Booking System Trafft
Researcher
More Details >

Chartbeat <= 2.0.7 – Authenticated (Subscriber+) Server-Side Request Forgery

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-53250
Patch Status
Unpatched
Published
Aug 26, 2025
Affected Software
Chartbeat
Researcher
More Details >

Chatbox Manager <= 1.2.6 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-58211
Patch Status
Patched
Published
Aug 27, 2025
Affected Software
Chatbox Manager
Researcher
More Details >

Dynamic AJAX Product Filters for WooCommerce <= 1.3.7 – Authenticated (Contributor+) Stored Cross-Site Scripting via className Parameter

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-6255
Patch Status
Patched
Published
Aug 27, 2025
Affected Software
Dynamic AJAX Product Filters for WooCommerce
Researcher
More Details >

Dynamic AJAX Product Filters for WooCommerce <= 1.3.7 – Authenticated (Contributor+) Stored Cross-Site Scripting via name Parameter

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-8073
Patch Status
Patched
Published
Aug 27, 2025
Affected Software
Dynamic AJAX Product Filters for WooCommerce
Researcher
More Details >

ElementInvader Addons for Elementor <= 1.3.6 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-58205
Patch Status
Patched
Published
Aug 27, 2025
Affected Software
ElementInvader Addons for Elementor
Researcher
More Details >

Epeken All Kurir <= 2.0.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-58212
Patch Status
Patched
Published
Aug 27, 2025
Affected Software
Epeken All Kurir Plugin for Woocommerce Full Version
Researcher
More Details >

Events Addon for Elementor <= 2.2.9 – Authenticated (Contributor+) Stored Cross-Site Scripting via Typewriter and Countdown Widgets

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-8150
Patch Status
Patched
Published
Aug 28, 2025
Affected Software
Events Addon for Elementor
Researcher
More Details >

Lazy Load for Videos <= 2.18.7 – Authenticated (Contributor+) Stored Cross-Site Scripting via data-video-title and href Attributes

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-7732
Patch Status
Patched
Published
Aug 26, 2025
Affected Software
Lazy Load for Videos
Researcher
More Details >

Link View <= 0.8.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-48110
Patch Status
Unpatched
Published
Aug 25, 2025
Affected Software
Link View
Researcher
More Details >

List Subpages <= 1.0.6 – Authenticated (Contributor+) Stored Cross-Site Scripting via title Parameter

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-8290
Patch Status
Unpatched
Published
Aug 28, 2025
Affected Software
List Subpages
Researcher
More Details >

Ocean Extra <= 2.4.9 – Authenticated (Contributor+) Stored Cross-Site Scripting via oceanwp_library Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-9499
Patch Status
Patched
Published
Aug 29, 2025
Affected Software
Ocean Extra
Researcher
More Details >

OSM Map Widget for Elementor <= 1.3.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via Button URL

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-8619
Patch Status
Unpatched
Published
Aug 28, 2025
Affected Software
OSM Map Widget for Elementor
Researcher
More Details >

PDF for Elementor Forms + Drag And Drop Template Builder <= 6.2.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-58208
Patch Status
Patched
Published
Aug 27, 2025
Affected Software
PDF for Elementor Forms + Drag And Drop Template Builder
Researcher
More Details >

Responsive Mobile-Friendly Tooltip <= 1.6.6 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-48316
Patch Status
Unpatched
Published
Aug 25, 2025
Affected Software
Responsive Mobile-Friendly Tooltip
Researcher
More Details >

Simple Download Monitor <= 3.9.34 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-58197
Patch Status
Patched
Published
Aug 27, 2025
Affected Software
Simple Download Monitor
Researcher
More Details >

SiteSEO – SEO Simplified <= 1.2.7 – Authenticated (Contributor+) Stored Cross-Site Scripting via Broken Regex Expression

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-9277
Patch Status
Patched
Published
Aug 26, 2025
Affected Software
SiteSEO – SEO Simplified
Researcher
More Details >

Solace Extra <= 1.3.2 – Authenticated (Admin+) Server-Side Request Forgery

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-58203
Patch Status
Patched
Published
Aug 27, 2025
Affected Software
Solace Extra
Researcher
More Details >

TablePress <= 3.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode_debug Parameter

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-9500
Patch Status
Patched
Published
Aug 29, 2025
Affected Software
TablePress – Tables in WordPress made easy
Researcher
More Details >

Transcoder <= 1.4.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-58209
Patch Status
Patched
Published
Aug 27, 2025
Affected Software
Transcoder
Researcher
More Details >

UiCore Elements <= 1.3.4 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-58196
Patch Status
Patched
Published
Aug 27, 2025
Affected Software
UiCore Elements – Free Elementor widgets and templates
Researcher
More Details >

Unlimited Elements For Elementor <= 1.5.148 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-8603
Patch Status
Patched
Published
Aug 27, 2025
Affected Software
Unlimited Elements For Elementor
Researcher
More Details >

UsersWP <= 1.2.42 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-9344
Patch Status
Patched
Published
Aug 27, 2025
Affected Software
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP
Researcher
More Details >

WordPress HTML <= 0.51 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-48315
Patch Status
Unpatched
Published
Aug 25, 2025
Affected Software
WordPress HTML
Researcher
More Details >

WPAvatar <= 1.9.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-48312
Patch Status
Unpatched
Published
Aug 25, 2025
Affected Software
WPAvatar
Researcher
More Details >

Xpro Elementor Addons <= 1.4.17 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-58195
Patch Status
Patched
Published
Aug 27, 2025
Affected Software
140+ Widgets | Xpro Addons For Elementor – FREE
Researcher
More Details >

Beaver Builder Plugin (Lite Version) <= 2.9.2.1 – Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-8897
Patch Status
Patched
Published
Aug 27, 2025
Affected Software
Beaver Builder – WordPress Page Builder
Researcher
More Details >

BetPress <= 1.0.1 Lite – Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-48309
Patch Status
Unpatched
Published
Aug 25, 2025
Affected Software
BetPress
Researcher
More Details >

Captcha.eu <= 1.0.60 – Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-53579
Patch Status
Patched
Published
Aug 26, 2025
Affected Software
Captcha.eu
Researcher
More Details >

Golo <= 1.7.1 – Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-54724
Patch Status
Patched
Published
Aug 26, 2025
Affected Software
Golo – City Travel Guide WordPress Theme
Researcher
More Details >

Google XML News Sitemap plugin <= 0.02 – Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-48304
Patch Status
Unpatched
Published
Aug 25, 2025
Affected Software
Google XML News Sitemap plugin
Researcher
More Details >

Houzez <= 4.1.1 – Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-49407
Patch Status
Patched
Published
Aug 27, 2025
Affected Software
Houzez
Researcher
More Details >

Invisible Optin <= 1.0 – Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-48311
Patch Status
Unpatched
Published
Aug 25, 2025
Affected Software
Invisible Optin
Researcher
More Details >

Newsletter subscription optin module <= 1.2.9 – Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-48308
Patch Status
Unpatched
Published
Aug 25, 2025
Affected Software
Newsletter subscription optin module
Researcher
More Details >

NextGEN Gallery Search <= 2.12 – Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-53224
Patch Status
Unpatched
Published
Aug 25, 2025
Affected Software
NextGEN Gallery Search
Researcher
More Details >

Podlove Podcast Publisher <= 4.2.5 – Open Redirect

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-58204
Patch Status
Patched
Published
Aug 27, 2025
Affected Software
Podlove Podcast Publisher
Researcher
More Details >

Savyour Affiliate Partner <= 2.1.4 – Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-48306
Patch Status
Unpatched
Published
Aug 25, 2025
Affected Software
Savyour Affiliate Partner
Researcher
More Details >

Theme Blvd Widget Areas <= 1.3.0 – Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-53289
Patch Status
Unpatched
Published
Aug 26, 2025
Affected Software
Theme Blvd Widget Areas
Researcher
More Details >

Theme Switcher Reloaded <= 1.1 – Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-53223
Patch Status
Unpatched
Published
Aug 25, 2025
Affected Software
Theme Switcher Reloaded
Researcher
More Details >

WP ULike Pro <= 1.9.3 – Unauthenticated Limited Arbitrary File Upload

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-9648
Patch Status
Patched
Published
Aug 27, 2025
Affected Software
WP ULike Pro
Researcher
More Details >

XmasB Quotes <= 1.6.1 – Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-53220
Patch Status
Unpatched
Published
Aug 26, 2025
Affected Software
XmasB Quotes
Researcher
More Details >

Yahoo! WebPlayer <= 2.0.6 – Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-53215
Patch Status
Unpatched
Published
Aug 26, 2025
Affected Software
Yahoo! WebPlayer
Researcher
More Details >

Amministrazione Trasparente <= 9.0 – Authenticated (Administrator+) Stored Cross-Site Scripting via print_r Function

5.5
CVSS Rating
Medium (5.5)
CVE-ID
CVE-2025-5083
Patch Status
Patched
Published
Aug 30, 2025
Affected Software
Amministrazione Trasparente
Researcher
More Details >

Pronamic Google Maps <= 2.4.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2025-9352
Patch Status
Patched
Published
Aug 27, 2025
Affected Software
Pronamic Google Maps
Researcher
More Details >

AfterShip Tracking <= 1.17.17 – Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-58201
Patch Status
Patched
Published
Aug 27, 2025
Affected Software
AfterShip Tracking – All-In-One WooCommerce Order Tracking (Free plan available)
Researcher
More Details >

Ajax Search Lite <= 4.13.1 – Missing Authorization to Unauthenticated Basic Information Exposure via ASL_Query in AJAX Search Handler

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-7956
Patch Status
Patched
Published
Aug 27, 2025
Affected Software
Ajax Search Lite – Live Search & Filter
Researcher
More Details >

All Bootstrap Blocks <= 1.3.28 – Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-54733
Patch Status
Patched
Published
Aug 26, 2025
Affected Software
All Bootstrap Blocks
Researcher
More Details >

B Slider <= 1.1.30 – Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-54734
Patch Status
Patched
Published
Aug 26, 2025
Affected Software
B Slider – Responsive Image Slider
Researcher
More Details >

Makeaholic <= 1.8.5 – Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-58210
Patch Status
Patched
Published
Aug 27, 2025
Affected Software
Makeaholic – Beauty Cosmetics WordPress Theme
Researcher
More Details >

Otter – Gutenberg Block <= 3.1.0 – Unauthenticated Sensitive Information Exposure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-55715
Patch Status
Patched
Published
Aug 27, 2025
Affected Software
Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE
Researcher
More Details >

Printeers Print & Ship <= 1.17.0 – Unauthenticated Path Traversal

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-48081
Patch Status
Unpatched
Published
Aug 27, 2025
Affected Software
Printeers Print & Ship
Researcher
More Details >

WooCommerce Payment Gateway for Saferpay <= 0.4.9 – Unauthenticated Path Traversal

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-48317
Patch Status
Unpatched
Published
Aug 26, 2025
Affected Software
WooCommerce Payment Gateway for Saferpay
Researcher
More Details >

File Manager, Code Editor, and Backup by Managefy <= 1.4.8 – Authenticated (Admin+) Path Traversal to Arbitrary File Download

4.9
CVSS Rating
Medium (4.9)
CVE-ID
CVE-2025-9345
Patch Status
Patched
Published
Aug 27, 2025
Affected Software
File Manager, Code Editor, and Backup by Managefy
Researcher
More Details >

WordPress Automatic Plugin – AI content generator and auto poster plugin <= 3.118.0 – Cross-Site Request Forgery to Stored Cross-Site Scripting

4.7
CVSS Rating
Medium (4.7)
CVE-ID
CVE-2025-6247
Patch Status
Patched
Published
Aug 25, 2025
Affected Software
WordPress Automatic Plugin
Researcher
More Details >

Add Code To Head <= 1.17 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2025-48314
Patch Status
Unpatched
Published
Aug 25, 2025
Affected Software
Add Code To Head
Researcher
Bao
More Details >

All-in-One WP Migration and Backup <= 7.97 – Authenticated (Administrator+) Stored Cross-Site Scripting via Import

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2025-8490
Patch Status
Patched
Published
Aug 26, 2025
Affected Software
All-in-One WP Migration and Backup
Researcher
More Details >

Goal Tracker for Patreon <= 0.4.6 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2025-48305
Patch Status
Unpatched
Published
Aug 25, 2025
Affected Software
Goal Tracker for Patreon
Researcher
More Details >

Tripadvisor Shortcode <= 2.2 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2025-48313
Patch Status
Unpatched
Published
Aug 25, 2025
Affected Software
Tripadvisor Shortcode
Researcher
More Details >

WP Thumbtack Review Slider <= 2.6 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2025-58216
Patch Status
Patched
Published
Aug 27, 2025
Affected Software
WP Thumbtack Review Slider
Researcher
More Details >

Houzez CRM <= 1.4.7 – Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-49402
Patch Status
Patched
Published
Aug 27, 2025
Affected Software
Houzez CRM
Researcher
More Details >

Instant Breaking News <= 1.0 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-58217
Patch Status
Patched
Published
Aug 27, 2025
Affected Software
Instant Breaking News
Researcher
More Details >

LiquidThemes Themes <= Various Versions – Missing Authorization to Authenticated (Subscriber+) All Plugins Deactivated

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-0951
Patch Status
Unpatched
Published
Aug 27, 2025
Affected Software
AI Hub – Startup & Technology WordPress Theme
ArcHub – Architecture and Interior Design WordPress Theme
Hub – Responsive Multi-Purpose WordPress Theme
Researcher
More Details >

LWSCache <= 2.8.5 – Missing Authorization to Authenticated (Subscriber+) Limited Plugin Activation via lwscache_activatePlugin Function

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-8147
Patch Status
Patched
Published
Aug 28, 2025
Affected Software
LWSCache
Researcher
More Details >

Page Manager for Elementor <= 2.0.5 – Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-53230
Patch Status
Unpatched
Published
Aug 25, 2025
Affected Software
Page Manager for Elementor
Researcher
More Details >

Post Type Converter <= 0.6 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-48303
Patch Status
Unpatched
Published
Aug 25, 2025
Affected Software
Post Type Converter
Researcher
More Details >

PPWP – Password Protect Pages <= 1.9.10 – Authenticated (Subscriber+) Content Exposure via REST API

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-5998
Patch Status
Patched
Published
Aug 25, 2025
Affected Software
PPWP – Password Protect WordPress | #1 Most-Reviewed Password Plugin
Researcher
More Details >

Pro Bulk Watermark Plugin for WordPress <= 2.0 – Authenticated (Subscriber+) Path Traversal

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-4956
Patch Status
Unpatched
Published
Aug 25, 2025
Affected Software
Pro Bulk Watermark Plugin for WordPress
Researcher
More Details >

Related Posts Lite <= 1.12 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-9618
Patch Status
Unpatched
Published
Aug 29, 2025
Affected Software
Related Posts Lite
Researcher
More Details >

SEO For Images <= 1.0.0 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-48307
Patch Status
Unpatched
Published
Aug 25, 2025
Affected Software
SEO For Images
Researcher
More Details >

Simple Page Access Restriction <= 1.0.32 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-58202
Patch Status
Patched
Published
Aug 27, 2025
Affected Software
Simple Page Access Restriction
Researcher
More Details >

Table Editor <= 1.6.4 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-48310
Patch Status
Unpatched
Published
Aug 25, 2025
Affected Software
Table Editor
Researcher
More Details >

Tiktok Feed <= 1.0.21 – Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-54710
Patch Status
Patched
Published
Aug 26, 2025
Affected Software
Feeds For TikTok – Show TikTok Videos in Grid or Feed Layout
Researcher
More Details >

Ultimate Tag Warrior Importer <= 0.2 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-9374
Patch Status
Unpatched
Published
Aug 28, 2025
Affected Software
Ultimate Tag Warrior Importer
Researcher
More Details >

Uncanny Automator <= 6.7.0.1 – Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-58193
Patch Status
Patched
Published
Aug 27, 2025
Affected Software
Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin
Researcher
More Details >

WP Bulk Delete <= 1.3.6 – Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-58192
Patch Status
Patched
Published
Aug 27, 2025
Affected Software
WP Bulk Delete
Researcher
More Details >

XM-Backup <= 0.9.1 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-48109
Patch Status
Unpatched
Published
Aug 25, 2025
Affected Software
XM-Backup
Researcher
More Details >

Xpro Theme Builder <= 1.2.9 – Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-58198
Patch Status
Patched
Published
Aug 27, 2025
Affected Software
Xpro Theme Builder For Elementor – FREE
Researcher
More Details >

Zephyr Project Manager <= 3.3.201 – Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-54714
Patch Status
Patched
Published
Aug 26, 2025
Affected Software
Zephyr Project Manager
Researcher
More Details >

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

The post Wordfence Intelligence Weekly WordPress Vulnerability Report (August 25, 2025 to August 31, 2025) appeared first on Wordfence.

Leave a Comment