Last week, there were 259 vulnerabilities disclosed in 199 WordPress Plugins and 5 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 142 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.
Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back.
Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 35,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
New Firewall Rules Deployed Last Week
The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.
The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:
- Pods <= 3.3.9 – Unauthenticated Privilege Escalation via Authorization Bypass to Admin Methods via ‘pods_admin’ AJAX Router
- Wishlist Member X <= 3.34.1 – Unauthenticated Account Takeover via ‘mergewith’ Parameter
- WAF-RULE-946 – Data redacted while we work with the vendor on a patch.
- WAF-RULE-947 – Data redacted while we work with the vendor on a patch.
- WAF-RULE-950 – Data redacted while we work with the vendor on a patch.
Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.
Total Unpatched & Patched Vulnerabilities Last Week
| Patch Status | Number of Vulnerabilities |
|---|---|
| Patched | 204 |
| Unpatched | 55 |
Total Vulnerabilities by CVSS Severity Last Week
| Severity Rating | Number of Vulnerabilities |
|---|---|
| Medium Severity | 157 |
| High Severity | 74 |
| Critical Severity | 28 |
Total Vulnerabilities by CWE Type Last Week
| Vulnerability Type by CWE | Number of Vulnerabilities |
|---|---|
| Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) | 59 |
| Missing Authorization | 50 |
| Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) | 38 |
| Authorization Bypass Through User-Controlled Key | 14 |
| Exposure of Sensitive Information to an Unauthorized Actor | 14 |
| Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) | 13 |
| Deserialization of Untrusted Data | 9 |
| Improper Privilege Management | 9 |
| Unrestricted Upload of File with Dangerous Type | 8 |
| Server-Side Request Forgery (SSRF) | 7 |
| Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’) | 5 |
| Improper Control of Generation of Code (‘Code Injection’) | 5 |
| Incorrect Privilege Assignment | 5 |
| Cross-Site Request Forgery (CSRF) | 4 |
| Client-Side Enforcement of Server-Side Security | 3 |
| Improper Authentication | 3 |
| Authentication Bypass Using an Alternate Path or Channel | 2 |
| Execution with Unnecessary Privileges | 1 |
| Improper Access Control | 1 |
| Improper Authorization | 1 |
| Improper Input Validation | 1 |
| Improper Neutralization of Special Elements in Output Used by a Downstream Component (‘Injection’) | 1 |
| Incorrect Authorization | 1 |
| Incorrect Comparison | 1 |
| Incorrect Type Conversion or Cast | 1 |
| Relative Path Traversal | 1 |
| Uncontrolled Resource Consumption | 1 |
| Weak Password Recovery Mechanism for Forgotten Password | 1 |
Researchers That Contributed to WordPress Security Last Week
| Researcher Name | Number of Vulnerabilities |
|---|---|
| 29 | |
| 10 | |
| 9 | |
| 6 | |
| 5 | |
| 5 | |
| 5 | |
| 5 | |
| 5 | |
| 5 | |
| 4 | |
| 4 | |
| 4 | |
| 4 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.
WordPress Plugins with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| 6Storage Rentals | 6storage-rentals |
| Accordions – Responsive Accordion & FAQ Plugin for WordPress | accordions-wp |
| AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress | acymailing |
| Admin Custom Login | admin-custom-login |
| Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution | file-manager-advanced |
| affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display | affiliate-toolkit-starter |
| Anti Spam and list cleaner – AcyChecker | acychecker |
| Appointment Booking Plugin for WooCommerce | Online Booking Calendar & Service Manager | service-booking-manager |
| Arvow AI SEO Writer | journalist-ai |
| Astro Booking Engine | astro-booking-engine |
| Autopay | platnosci-online-blue-media |
| Beaver Builder Page Builder – Drag and Drop Website Builder | beaver-builder-lite-version |
| Biagiotti Core | biagiotti-core |
| Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder | bit-form |
| Blog Floating Button | blog-floating-button |
| bLoyal: Loyalty & Promotions by bLoyal | bloyal |
| Bold Page Builder | bold-page-builder |
| Booking Activities | booking-activities |
| Booking calendar, Appointment Booking System | booking-calendar |
| Booking for Appointments and Events Calendar – Amelia | ameliabooking |
| Booktics – Appointment Booking Calendar for Service Businesses | booktics |
| Breeze Cache | breeze |
| Business Directory Plugin – Easy Listing Directories for WordPress | business-directory-plugin |
| Car Rental Manager – Online Vehicle Booking System | car-rental-manager |
| Church Admin | church-admin |
| Colissimo shipping methods for WooCommerce | colissimo-shipping-methods-for-woocommerce |
| Contact Form 7 – PayPal & Stripe Add-on | contact-form-7-paypal-add-on |
| Contact Form, Survey, Quiz & Popup Form Builder – ARForms | arforms-form-builder |
| Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe | contest-gallery |
| Cookie Consent – GDPR & CCPA Cookie Banner & Consent Manager | cookiez |
| CubeWP Framework | cubewp-framework |
| Customer Email Verification for WooCommerce | emails-verification-for-woocommerce |
| Directories Pro – Directory plugin for WordPress | directories-pro |
| E-cab Taxi Booking Manager for Woocommerce | ecab-taxi-booking-manager |
| Echo Knowledge Base – Documentation, FAQs, Chat & Smart Search | echo-knowledge-base |
| ECS – Ele Custom Skin for Elementor | ele-custom-skin |
| Ecwid by Lightspeed Ecommerce Shopping Cart | ecwid-shopping-cart |
| Embed Google Photos album | embed-google-photos-album-easily |
| Epeken All Kurir for Woocommerce | epeken-all-kurir |
| Essential Addons for Elementor – Popular Elementor Templates & Widgets | essential-addons-for-elementor-lite |
| Essential Real Estate | essential-real-estate |
| Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce | wp-event-solution |
| Events Manager – Calendar, Bookings, Tickets, and more! | events-manager |
| Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin | everest-backup |
| Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI | everest-forms |
| Extra Product Options & Add-Ons for WooCommerce | woocommerce-tm-extra-product-options |
| Ezoic | ezoic-integration |
| Featured Image from URL (FIFU) | featured-image-from-url |
| Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder | fluentform |
| FluentCommunity – Ultra-Fast High-Performance Social Network, Community, LMS & Online Courses | fluent-community |
| Food Menu – Restaurant Menu & Online Ordering for WooCommerce | tlp-food-menu |
| Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder | form-maker |
| Formidable Digital Signatures | formidable-signature |
| Forminator Forms – Contact Form, Payment Form & Custom Form Builder | forminator |
| Foton Core | foton-core |
| Frontend Admin by DynamiApps | acf-frontend-form-element |
| Frontend File Manager Plugin | nmedia-user-file-uploader |
| Fullscreen Galleria | fullscreen-galleria |
| FundEngine – Donation and Crowdfunding Platform | wp-fundraising-donation |
| Gallery by BestWebSoft – Customizable Image and Photo Galleries for WordPress | gallery-plugin |
| GeoDirectory – WP Business Directory Plugin and Classified Listings Directory | geodirectory |
| Gift Cards For WooCommerce Pro | giftware |
| GiveWP – Donation Plugin and Fundraising Platform | give |
| Gravity Booster – Styles & Layouts for Gravity Forms | styles-and-layouts-for-gravity-forms |
| Groundhogg — CRM, Newsletters, and Marketing Automation | groundhogg |
| Gutenverse Companion | gutenverse-companion |
| Headless SSO Plugin for WP | headless-single-sign-on |
| Hydra Booking — Appointment Scheduling & Booking Calendar | hydra-booking |
| iCARRY | icarry |
| Image Uploader for Welcart | image-uploader-for-welcart |
| Import WP – Export and Import CSV and XML files to WordPress | jc-importer |
| Infility Global | infility-global |
| InstaWP Connect – 1-click WP Staging & Migration | instawp-connect |
| Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms | gdpr-compliant-recaptcha-for-all-forms |
| Kadence Starter Templates — Predesigned Website Templates | kadence-starter-templates |
| Kirki – Freeform Page Builder, Website Builder & Customizer | kirki |
| KiviCare – Clinic & Patient Management System (EHR) | kivicare-clinic-management-system |
| Kubio AI Page Builder | kubio |
| LearnPress – WordPress LMS Plugin for Create and Sell Online Courses | learnpress |
| Link Library | link-library |
| Listdom: AI-powered Business Directory with Classifieds Ads Listings | listdom |
| Local Delivery Drivers for WooCommerce | local-delivery-drivers-for-woocommerce |
| Loco Translate | loco-translate |
| Log in with Google | login-with-google |
| Mailchimp for WooCommerce | mailchimp-for-woocommerce |
| MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder | mailchimp-subscribe-sm |
| Mang Board WP | mangboard |
| Maspik – Multi-Layer Spam Protection | contact-forms-anti-spam |
| MaxUpload – Big File Uploads – Increase Maximum File Upload Size | maxupload-upload-larger-files-easily |
| miniOrange OTP Login, Verification and SMS Notifications | miniorange-otp-verification |
| Motors – Car Dealership & Classified Listings Plugin | motors-car-dealership-classified-listings |
| MStore API – Create Native Android & iOS Apps On The Cloud | mstore-api |
| MultiParcels Shipping For WooCommerce | multiparcels-shipping-for-woocommerce |
| NEX-Forms – Ultimate Forms Plugin for WordPress | nex-forms-express-wp-form-builder |
| Object Sync for Salesforce | object-sync-for-salesforce |
| OMGF Pro | host-google-fonts-pro |
| Online Booking & Scheduling Calendar for WordPress by vcita | meeting-scheduler-by-vcita |
| Online Scheduling and Appointment Booking System – Bookly | bookly-responsive-appointment-booking-tool |
| Order Sync with Zendesk for WooCommerce | mwb-zendesk-woo-order-sync |
| OttoKit: All-in-One Automation Platform | suretriggers |
| Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress | wp-user-avatar |
| Participants Database | participants-database |
| Patterns Kit | patterns-kit |
| Payment Forms for Paystack | payment-forms-for-paystack |
| Payment Gateway for PayPal on WooCommerce | woo-paypal-gateway |
| Paymob for WooCommerce | paymob-for-woocommerce |
| Pinpoint Booking System – Version 2 | booking-system |
| Piotnet Addons For Elementor Pro | piotnet-addons-for-elementor-pro |
| Podlove Podcast Publisher | podlove-podcasting-plugin-for-wordpress |
| Pods – Custom Content Types and Fields | pods |
| PowerPress Podcasting plugin by Blubrry | powerpress |
| PPWP – Password Protect Pages | password-protect-page |
| Prevent Direct Access – Protect WordPress Files | prevent-direct-access |
| Product Feed Manager for WooCommerce – CTXFeed – Support 220+ Shopping & Social Channels | webappick-product-feed-for-woocommerce |
| Product Table & List Builder for WooCommerce – Create WooCommerce Product Tables | wc-product-table-lite |
| Propovoice: All-in-One Client Management System | propovoice |
| ProSolution WP Client | prosolution-wp-client |
| QA Assistants – Driven by data | qa-heatmap-analytics |
| Query Wrangler | query-wrangler |
| Quill Forms | Conversational Multi Step Forms, Surveys & quizzes | quillforms |
| Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker | quiz-master-next |
| RapiSafe – Secure Multi File Upload for Contact Form 7 | rapisafe-multi-file-cf7 |
| Ray Enterprise Translation | lingotek-translation |
| Real Estate Manager Pro | real-estate-manager-pro |
| reviewer | reviewer |
| Revolut Gateway for WooCommerce | revolut-gateway-for-woocommerce |
| Royal Addons for Elementor – Addons and Templates Kit for Elementor | royal-elementor-addons |
| Salon Booking System – Appointment Booking for Salons, Barbershops & Spas | salon-booking-system |
| SAML Single Sign On – SSO Login | miniorange-saml-20-single-sign-on |
| School Management System for WordPress | school-management |
| Serious Slider | cryout-serious-slider |
| Service Finder Bookings | sf-booking |
| ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets | shopengine |
| ShopSmart Loyalty for WooCommerce | shopsmart-loyalty-for-woocommerce |
| ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization | shortpixel-adaptive-images |
| Simply Schedule Appointments | simply-schedule-appointments |
| Site Reviews | site-reviews |
| Slider Hero with Video Background, Animation | slider-hero |
| Smart Online Order for Clover | clover-online-orders |
| Smart Popup by Supsystic | popup-by-supsystic |
| Smash Balloon Social Post Feed – Simple Social Feeds for WordPress | custom-facebook-feed |
| Snippet Shortcodes | shortcode-variables |
| Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect | ventraconnect-social-login |
| Solace Extra | solace-extra |
| StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More | storeengine |
| StoreGrowth – Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce | storegrowth-sales-booster |
| SureDash – Community, Courses & Member Dashboard | suredash |
| Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent | tablesome |
| Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud! | templately |
| The Grid | the-grid |
| The School Management – Education & Learning ERP | school-management-system |
| Theme Test Drive | theme-test-drive |
| Thim Core | thim-core |
| ToneDen Shortcode | lasso |
| Toocheke Companion | toocheke-companion |
| Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid | boldgrid-backup |
| Tour Master – Tour Booking, Travel, Hotel | tourmaster |
| Tourfic Toolkit | travelfic-toolkit |
| Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin | tourfic |
| TrueBooker – Appointment Booking and Scheduler System | truebooker-appointment-booking |
| Turnkey bbPress by WeaverTheme | weaver-for-bbpress |
| User Access Manager | user-access-manager |
| User Login History | user-login-history |
| User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor | profile-builder |
| User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder | user-registration |
| User Session Synchronizer | user-session-synchronizer |
| Vavo Core | vavo-core |
| Vehica Core | vehica-core |
| Video Gallery – YouTube Gallery, Playlist & Video Grid | youtube-showcase |
| Visitor Traffic Real Time Statistics | visitors-traffic-real-time-statistics |
| W3 Total Cache | w3-total-cache |
| Wallet for WooCommerce | woo-wallet |
| Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments | wallet-system-for-woocommerce |
| WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors | wc-vendors |
| WCPOS – Point of Sale (POS) plugin for WooCommerce | woocommerce-pos |
| Web Directory Free | web-directory-free |
| WebHosting4U Secure Card Gateway for ePay Paycenter (Piraeus Bank) | secure-card-gateway-for-epay-paycenter-piraeus-bank |
| Website Internal Link Optimiser | internal-link-finder |
| Welcart e-Commerce | usc-e-shop |
| Wholesale Market | wholesale-market |
| Wishlist Member | wishlist-member-x |
| WooCommerce Appointments | woocommerce-appointments |
| WooCommerce Subscription | woocommerce-subscriptions |
| WooMS | wooms |
| WP BASE Booking of Appointments, Services and Events | wp-base-booking-of-appointments-services-and-events |
| WP Compress – Instant Performance & Speed Optimization | wp-compress-image-optimizer |
| WP Crowdfunding | wp-crowdfunding |
| WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards | wp-data-access |
| WP Directory Kit | wpdirectorykit |
| WP Helper Premium | wp-helper-lite |
| WP Photo Album Plus | wp-photo-album-plus |
| WP Sort Order | wp-sort-order |
| WP Travel Engine – Tour Booking Plugin – Tour Operator Software | wp-travel-engine |
| WP Umbrella: Security Backup Restore & Monitoring | wp-health |
| WPC Admin Columns | wpc-admin-columns |
| WPJAM Basic | wpjam-basic |
| WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode | gdpr-cookie-consent |
| WPML Multilingual CMS | sitepress-multilingual-cms |
| WPMobile.App | wpappninja |
WordPress Themes with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| Barista | barista |
| Cartify – WooCommerce Gutenberg WordPress Theme | cartify-multipurpose-woocommerce-wordpress-theme |
| Divi | Divi |
| Nokri – Job Board WordPress Theme | nokri |
| Samex – Clean, Minimal Shop WooCommerce WordPress Theme | samex |
Vulnerability Details
Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.
Affected Software
6Storage Rentals [6storage-rentals]
Affected Software
Contact Form, Survey, Quiz & Popup Form Builder – ARForms [arforms-form-builder]
Researcher
Affected Software
Customer Email Verification for WooCommerce [emails-verification-for-woocommerce]
Researcher
Affected Software
Ezoic [ezoic-integration]
Researcher
Formidable Digital Signatures <= 3.0.6 – Unauthenticated Arbitrary File Deletion via Signature Field
9.8
Affected Software
Formidable Digital Signatures [formidable-signature]
Researcher
Affected Software
Frontend Admin by DynamiApps [acf-frontend-form-element]
Researcher
Affected Software
Gift Cards For WooCommerce Pro [giftware]
Researcher
KiviCare – Clinic & Patient Management System (EHR) < 4.5.2 – Unauthenticated Privilege Escalation
9.8
Affected Software
KiviCare – Clinic & Patient Management System (EHR) [kivicare-clinic-management-system]
Researcher
Affected Software
Log in with Google [login-with-google]
Researcher
Affected Software
miniOrange OTP Login, Verification and SMS Notifications [miniorange-otp-verification]
Researcher
Affected Software
Researcher
Affected Software
Piotnet Addons For Elementor Pro [piotnet-addons-for-elementor-pro]
Researcher
Affected Software
Researchers
Affected Software
ProSolution WP Client [prosolution-wp-client]
Researcher
Affected Software
QA Assistants – Driven by data [qa-heatmap-analytics]
Researcher
Affected Software
SAML Single Sign On – SSO Login [miniorange-saml-20-single-sign-on]
Researcher
Affected Software
TrueBooker – Appointment Booking and Scheduler System [truebooker-appointment-booking]
Researcher
Affected Software
Researcher
Affected Software
User Session Synchronizer [user-session-synchronizer]
Affected Software
Wishlist Member [wishlist-member-x]
Researcher
Affected Software
WP BASE Booking of Appointments, Services and Events [wp-base-booking-of-appointments-services-and-events]
Researcher
Affected Software
Frontend File Manager Plugin [nmedia-user-file-uploader]
Researcher
Affected Software
Link Library [link-library]
Researcher
Affected Software
Participants Database [participants-database]
Researcher
Affected Software
WP Photo Album Plus [wp-photo-album-plus]
Researcher
Affected Software
ProSolution WP Client [prosolution-wp-client]
Researcher
Affected Software
RapiSafe – Secure Multi File Upload for Contact Form 7 [rapisafe-multi-file-cf7]
Researcher
Affected Software
Solace Extra [solace-extra]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Directories Pro – Directory plugin for WordPress [directories-pro]
Researcher
Affected Software
Frontend Admin by DynamiApps [acf-frontend-form-element]
Researcher
Affected Software
MaxUpload – Big File Uploads – Increase Maximum File Upload Size [maxupload-upload-larger-files-easily]
Researcher
Affected Software
Podlove Podcast Publisher [podlove-podcasting-plugin-for-wordpress]
Researcher
Affected Software
Propovoice: All-in-One Client Management System [propovoice]
Researcher
Query Wrangler <= 1.5.57 – Authenticated (Subscriber+) Remote Code Execution via ‘options’ Parameter
8.8
Affected Software
Query Wrangler [query-wrangler]
Researcher
Affected Software
Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons]
Researcher
Affected Software
Service Finder Bookings [sf-booking]
Researcher
Affected Software
Researcher
Affected Software
Thim Core [thim-core]
Researcher
Affected Software
Wholesale Market [wholesale-market]
Researcher
WordPress Core <= 7.0.3 – Authenticated (Author+) Remote Code Execution via Malicious File Upload
8.8
Affected Software
WordPress [wordpress]
Researcher
Affected Software
Barista [barista]
Researcher
Affected Software
Biagiotti Core [biagiotti-core]
Researcher
Affected Software
Booking Activities [booking-activities]
Researcher
Affected Software
Foton Core [foton-core]
Researcher
Affected Software
FundEngine – Donation and Crowdfunding Platform [wp-fundraising-donation]
Researcher
Affected Software
Researcher
Affected Software
Headless SSO Plugin for WP [headless-single-sign-on]
Researcher
Affected Software
Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect [ventraconnect-social-login]
Researcher
Affected Software
Theme Test Drive [theme-test-drive]
Researcher
Affected Software
Vavo Core [vavo-core]
Researcher
Affected Software
Church Admin [church-admin]
Researcher
Affected Software
WP Directory Kit [wpdirectorykit]
Researcher
Affected Software
WP Directory Kit [wpdirectorykit]
Researcher
Affected Software
Essential Real Estate [essential-real-estate]
Researcher
Affected Software
Researcher
Affected Software
Extra Product Options & Add-Ons for WooCommerce [woocommerce-tm-extra-product-options]
Researcher
Affected Software
InstaWP Connect – 1-click WP Staging & Migration [instawp-connect]
Researcher
Affected Software
Researcher
Affected Software
Object Sync for Salesforce [object-sync-for-salesforce]
Researcher
Affected Software
Paymob for WooCommerce [paymob-for-woocommerce]
Researcher
Affected Software
Real Estate Manager Pro [real-estate-manager-pro]
Researcher
Affected Software
Researcher
Affected Software
Web Directory Free [web-directory-free]
Researcher
Affected Software
WP Travel Engine – Tour Booking Plugin – Tour Operator Software [wp-travel-engine]
Researcher
Affected Software
Essential Addons for Elementor – Popular Elementor Templates & Widgets [essential-addons-for-elementor-lite]
Researcher
Affected Software
Events Manager – Calendar, Bookings, Tickets, and more! [events-manager]
Researcher
Affected Software
Payment Gateway for PayPal on WooCommerce [woo-paypal-gateway]
Researcher
Affected Software
Autopay [platnosci-online-blue-media]
Researcher
Affected Software
Blog Floating Button [blog-floating-button]
Researcher
Affected Software
Business Directory Plugin – Easy Listing Directories for WordPress [business-directory-plugin]
Researcher
Colissimo shipping methods for WooCommerce <= 2.10.0 – Unauthenticated Stored Cross-Site Scripting
7.2
Affected Software
Colissimo shipping methods for WooCommerce [colissimo-shipping-methods-for-woocommerce]
Researcher
Affected Software
Researcher
Affected Software
ToneDen Shortcode [lasso]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Gutenverse Companion [gutenverse-companion]
Researcher
Affected Software
Infility Global [infility-global]
Researcher
Affected Software
Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms [gdpr-compliant-recaptcha-for-all-forms]
Researcher
Affected Software
Echo Knowledge Base – Documentation, FAQs, Chat & Smart Search [echo-knowledge-base]
Researcher
Affected Software
Local Delivery Drivers for WooCommerce [local-delivery-drivers-for-woocommerce]
Researcher
Affected Software
MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder [mailchimp-subscribe-sm]
Researcher
Affected Software
Mang Board WP [mangboard]
Researcher
Affected Software
Maspik – Multi-Layer Spam Protection [contact-forms-anti-spam]
Researcher
Affected Software
Online Booking & Scheduling Calendar for WordPress by vcita [meeting-scheduler-by-vcita]
Researcher
Affected Software
Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool]
Researcher
Affected Software
OttoKit: All-in-One Automation Platform [suretriggers]
Researcher
Affected Software
Researcher
Affected Software
Site Reviews [site-reviews]
Researcher
Affected Software
Smart Online Order for Clover [clover-online-orders]
Researcher
Affected Software
Smart Popup by Supsystic [popup-by-supsystic]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Visitor Traffic Real Time Statistics [visitors-traffic-real-time-statistics]
Researcher
Affected Software
W3 Total Cache [w3-total-cache]
Researcher
Affected Software
WCPOS – Point of Sale (POS) plugin for WooCommerce [woocommerce-pos]
Researcher
Affected Software
Welcart e-Commerce [usc-e-shop]
Researcher
Affected Software
Car Rental Manager – Online Vehicle Booking System [car-rental-manager]
Researcher
Affected Software
Turnkey bbPress by WeaverTheme [weaver-for-bbpress]
Researcher
Affected Software
Simply Schedule Appointments [simply-schedule-appointments]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe [contest-gallery]
Researcher
Affected Software
CubeWP Framework [cubewp-framework]
Researcher
Affected Software
WP Directory Kit [wpdirectorykit]
Researcher
Affected Software
ToneDen Shortcode [lasso]
Researcher
Affected Software
ToneDen Shortcode [lasso]
Researcher
Affected Software
Events Manager – Calendar, Bookings, Tickets, and more! [events-manager]
Researcher
Affected Software
Researcher
Affected Software
Fullscreen Galleria [fullscreen-galleria]
Researcher
Affected Software
Researcher
Affected Software
Image Uploader for Welcart [image-uploader-for-welcart]
Researcher
Affected Software
KiviCare – Clinic & Patient Management System (EHR) [kivicare-clinic-management-system]
Researcher
Affected Software
KiviCare – Clinic & Patient Management System (EHR) [kivicare-clinic-management-system]
Researcher
Affected Software
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker [quiz-master-next]
Researcher
Affected Software
Researcher
The School Management <= 5.4 – Authenticated (Custom+) SQL Injection via ‘order[0][dir]’ Parameter
6.5
Affected Software
The School Management – Education & Learning ERP [school-management-system]
Researcher
Affected Software
WP Compress – Instant Performance & Speed Optimization [wp-compress-image-optimizer]
Researcher
Affected Software
WPJAM Basic [wpjam-basic]
Researcher
WPML Multilingual CMS <= 4.9.5 – Authenticated (Translator+) SQL Injection via ‘sorting’ Parameter
6.5
Affected Software
WPML Multilingual CMS [sitepress-multilingual-cms]
Researcher
Affected Software
Accordions – Responsive Accordion & FAQ Plugin for WordPress [accordions-wp]
Researcher
Affected Software
Researcher
Affected Software
Appointment Booking Plugin for WooCommerce | Online Booking Calendar & Service Manager [service-booking-manager]
Researcher
Affected Software
Beaver Builder Page Builder – Drag and Drop Website Builder [beaver-builder-lite-version]
Researcher
Affected Software
Bold Page Builder [bold-page-builder]
Researcher
Affected Software
ECS – Ele Custom Skin for Elementor [ele-custom-skin]
Researcher
Embed Google Photos Album Easily <= 2.2.1 – Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
Embed Google Photos album [embed-google-photos-album-easily]
Researcher
Featured Image from URL (FIFU) <= 5.3.3 – Authenticated (Contributor+) Stored Cross-site Scripting
6.4
Affected Software
Featured Image from URL (FIFU) [featured-image-from-url]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Hydra Booking — Appointment Scheduling & Booking Calendar [hydra-booking]
Researcher
Affected Software
Researcher
Affected Software
Loco Translate [loco-translate]
Researcher
Affected Software
Patterns Kit [patterns-kit]
Researcher
Affected Software
PowerPress Podcasting plugin by Blubrry [powerpress]
Researcher
Affected Software
PPWP – Password Protect Pages [password-protect-page]
Researcher
Affected Software
ProSolution WP Client [prosolution-wp-client]
Researcher
Affected Software
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker [quiz-master-next]
Researcher
Affected Software
Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons]
Researcher
Affected Software
Serious Slider [cryout-serious-slider]
Researcher
Affected Software
Smash Balloon Social Post Feed – Simple Social Feeds for WordPress [custom-facebook-feed]
Researcher
Affected Software
Snippet Shortcodes [shortcode-variables]
Researcher
Affected Software
Researcher
Affected Software
Toocheke Companion [toocheke-companion]
Researcher
Affected Software
Vehica Core [vehica-core]
Researcher
Affected Software
Video Gallery – YouTube Gallery, Playlist & Video Grid [youtube-showcase]
Researcher
Affected Software
Welcart e-Commerce [usc-e-shop]
Researcher
Affected Software
Researcher
Affected Software
WP Photo Album Plus [wp-photo-album-plus]
Researcher
Affected Software
Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution [file-manager-advanced]
Researcher
Affected Software
MultiParcels Shipping For WooCommerce [multiparcels-shipping-for-woocommerce]
Researcher
Affected Software
WP Photo Album Plus [wp-photo-album-plus]
Researcher
Affected Software
Researcher
Affected Software
WP Directory Kit [wpdirectorykit]
Researcher
Affected Software
Researchers
Affected Software
Anti Spam and list cleaner – AcyChecker [acychecker]
Researcher
Affected Software
Arvow AI SEO Writer [journalist-ai]
Researcher
Affected Software
Booking calendar, Appointment Booking System [booking-calendar]
Researcher
Affected Software
Breeze Cache [breeze]
Researcher
Affected Software
Cartify – WooCommerce Gutenberg WordPress Theme [cartify-multipurpose-woocommerce-wordpress-theme]
Researcher
Affected Software
Contact Form 7 – PayPal & Stripe Add-on [contact-form-7-paypal-add-on]
Researcher
Affected Software
ToneDen Shortcode [lasso]
Researcher
Affected Software
E-cab Taxi Booking Manager for Woocommerce [ecab-taxi-booking-manager]
Researcher
Affected Software
ECS – Ele Custom Skin for Elementor [ele-custom-skin]
Researcher
Affected Software
Epeken All Kurir for Woocommerce [epeken-all-kurir]
Researcher
Affected Software
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution]
Researcher
Affected Software
Ezoic [ezoic-integration]
Researcher
Affected Software
Food Menu – Restaurant Menu & Online Ordering for WooCommerce [tlp-food-menu]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Hydra Booking — Appointment Scheduling & Booking Calendar [hydra-booking]
Researcher
Affected Software
iCARRY [icarry]
Researcher
Affected Software
Researcher
Affected Software
InstaWP Connect – 1-click WP Staging & Migration [instawp-connect]
Researcher
Affected Software
Kadence Starter Templates — Predesigned Website Templates [kadence-starter-templates]
Researcher
Affected Software
Researcher
Affected Software
Order Sync with Zendesk for WooCommerce [mwb-zendesk-woo-order-sync]
Researcher
Affected Software
Pinpoint Booking System – Version 2 [booking-system]
Researchers
Prevent Direct Access – Protect WordPress Files <= 2.8.8.8 – Unauthenticated Protected File Access
5.3
Affected Software
Prevent Direct Access – Protect WordPress Files [prevent-direct-access]
Researcher
Affected Software
Product Table & List Builder for WooCommerce – Create WooCommerce Product Tables [wc-product-table-lite]
Researcher
Affected Software
Revolut Gateway for WooCommerce [revolut-gateway-for-woocommerce]
Researcher
Affected Software
School Management System for WordPress [school-management]
Researcher
Affected Software
WebHosting4U Secure Card Gateway for ePay Paycenter (Piraeus Bank) [secure-card-gateway-for-epay-paycenter-piraeus-bank]
Researcher
Affected Software
ShopSmart Loyalty for WooCommerce [shopsmart-loyalty-for-woocommerce]
Researcher
Affected Software
StoreGrowth – Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce [storegrowth-sales-booster]
Researcher
Affected Software
Researcher
Affected Software
WP Travel Engine – Tour Booking Plugin – Tour Operator Software [wp-travel-engine]
Researcher
Affected Software
User Access Manager [user-access-manager]
Researcher
Affected Software
Researcher
Affected Software
Website Internal Link Optimiser [internal-link-finder]
Researcher
Affected Software
Welcart e-Commerce [usc-e-shop]
Researcher
Affected Software
WooCommerce Appointments [woocommerce-appointments]
Researcher
Affected Software
WooCommerce Subscription [woocommerce-subscriptions]
Researcher
Affected Software
WP Helper Premium [wp-helper-lite]
Researcher
Affected Software
WP Photo Album Plus [wp-photo-album-plus]
Researcher
Affected Software
WP Sort Order [wp-sort-order]
Researcher
Affected Software
WPMobile.App [wpappninja]
Researcher
affiliate-toolkit <= 3.8.8 – Authenticated (Administrator+) SQL Injection via ‘orderby’ Parameter
4.9
Affected Software
affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display [affiliate-toolkit-starter]
Researcher
Invisible Anti-Spam & CAPTCHA <= 5.1 – Authenticated (Editor+) SQL Injection via ‘key’ Parameter
4.9
Affected Software
Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms [gdpr-compliant-recaptcha-for-all-forms]
Researcher
Affected Software
Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms [gdpr-compliant-recaptcha-for-all-forms]
Researcher
Kirki <= 6.1.1 – Authenticated (Editor+) Path Traversal to Arbitrary File Read via ‘data’ Parameter
4.9
Affected Software
Researcher
Affected Software
Mailchimp for WooCommerce [mailchimp-for-woocommerce]
Researcher
Affected Software
NEX-Forms – Ultimate Forms Plugin for WordPress [nex-forms-express-wp-form-builder]
Researcher
Affected Software
Product Feed Manager for WooCommerce – CTXFeed – Support 220+ Shopping & Social Channels [webappick-product-feed-for-woocommerce]
Researcher
Affected Software
Slider Hero with Video Background, Animation [slider-hero]
Researcher
User Login History <= 2.1.7 – Authenticated (Administrator+) SQL Injection via ‘blog_id’ Parameter
4.9
Affected Software
User Login History [user-login-history]
Researcher
Affected Software
Researcher
Affected Software
Admin Custom Login [admin-custom-login]
Researcher
Affected Software
Gravity Booster – Styles & Layouts for Gravity Forms [styles-and-layouts-for-gravity-forms]
Researcher
Affected Software
Researcher
Affected Software
Astro Booking Engine [astro-booking-engine]
Researcher
Affected Software
Booking for Appointments and Events Calendar – Amelia [ameliabooking]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
WP Crowdfunding [wp-crowdfunding]
Researcher
Affected Software
WP Crowdfunding [wp-crowdfunding]
Researcher
Affected Software
Ecwid by Lightspeed Ecommerce Shopping Cart [ecwid-shopping-cart]
Researcher
Affected Software
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution]
Researcher
Affected Software
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution]
Researcher
Affected Software
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution]
Researcher
Affected Software
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
KiviCare – Clinic & Patient Management System (EHR) [kivicare-clinic-management-system]
Researcher
Affected Software
Kubio AI Page Builder [kubio]
Researcher
Affected Software
Researcher
Affected Software
Motors – Car Dealership & Classified Listings Plugin [motors-car-dealership-classified-listings]
Researcher
Affected Software
Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool]
Researcher
Affected Software
PPWP – Password Protect Pages [password-protect-page]
Researcher
Affected Software
Payment Forms for Paystack [payment-forms-for-paystack]
Researcher
Affected Software
WP Photo Album Plus [wp-photo-album-plus]
Researcher
Affected Software
ProSolution WP Client [prosolution-wp-client]
Researcher
Affected Software
Ray Enterprise Translation [lingotek-translation]
Researcher
Affected Software
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas [salon-booking-system]
Researcher
Affected Software
Service Finder Bookings [sf-booking]
Researcher
Affected Software
Researcher
Affected Software
ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization [shortpixel-adaptive-images]
Researcher
Affected Software
Solace Extra [solace-extra]
Researcher
Affected Software
Wallet for WooCommerce [woo-wallet]
Researcher
Affected Software
Researcher
Affected Software
Tourfic Toolkit [travelfic-toolkit]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
WP Crowdfunding [wp-crowdfunding]
Researcher
Affected Software
WP Crowdfunding [wp-crowdfunding]
Researcher
Affected Software
Researcher
Affected Software
WPC Admin Columns [wpc-admin-columns]
Researcher
As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.
This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
The post Wordfence Intelligence Weekly WordPress Vulnerability Report (August 10, 2026 to August 16, 2026) appeared first on Wordfence.
