Last week, there were 268 vulnerabilities disclosed in 182 WordPress Plugins and 15 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 124 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.
Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, and webhook integration are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back.
Enterprises, Hosting Providers, and even Individuals can utilize the vulnerability Database API to receive a complete dump of our database of over 40,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
New Firewall Rules Deployed Last Week
The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.
The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:
Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.
Total Unpatched & Patched Vulnerabilities Last Week
| Patch Status | Number of Vulnerabilities |
|---|---|
| Patched | 225 |
| Unpatched | 43 |
Total Vulnerabilities by CVSS Severity Last Week
| Severity Rating | Number of Vulnerabilities |
|---|---|
| Low Severity | 6 |
| Medium Severity | 186 |
| High Severity | 69 |
| Critical Severity | 7 |
Total Vulnerabilities by CWE Type Last Week
| Vulnerability Type by CWE | Number of Vulnerabilities |
|---|---|
| Missing Authorization | 75 |
| Improper Neutralization of Input During Web Page Generation | 69 |
| Deserialization of Untrusted Data | 20 |
| Authorization Bypass Through User-Controlled Key | 16 |
| Improper Neutralization of Special Elements used in an SQL Command | 13 |
| Client-Side Enforcement of Server-Side Security | 11 |
| Exposure of Sensitive Information to an Unauthorized Actor | 10 |
| Improper Privilege Management | 8 |
| Improper Control of Generation of Code | 7 |
| Improper Authentication | 6 |
| Cross-Site Request Forgery | 5 |
| Incorrect Authorization | 5 |
| Insufficient Verification of Data Authenticity | 5 |
| Improper Control of Filename for Include/Require Statement in PHP Program | 4 |
| Improper Limitation of a Pathname to a Restricted Directory | 4 |
| Unrestricted Upload of File with Dangerous Type | 4 |
| Improper Input Validation | 2 |
| Guessable CAPTCHA | 1 |
| Improper Authorization | 1 |
| Improper Link Resolution Before File Access | 1 |
| Uncontrolled Resource Consumption | 1 |
Researchers That Contributed to WordPress Security Last Week
| Researcher Name | Number of Vulnerabilities |
|---|---|
| 22 | |
| 20 | |
| 11 | |
| 10 | |
| 9 | |
| 7 | |
| 6 | |
| 5 | |
| 5 | |
| 5 | |
| 5 | |
| 5 | |
| 4 | |
| 4 | |
| 4 | |
| 4 | |
| 4 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.
WordPress Plugins with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder | ablocks |
| Academist Core | academist-core |
| Ad Inserter – Ad Manager & AdSense Ads | ad-inserter |
| Addon Elements for Elementor (formerly Elementor Addon Elements) | addon-elements-for-elementor-page-builder |
| Advanced Custom Fields: Extended | acf-extended |
| Advanced Custom Fields: Extended PRO | acf-extended-pro |
| Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution | file-manager-advanced |
| Advanced Twenty Seventeen | advanced-twenty-seventeen |
| AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini | ai-engine |
| Ajax Search Lite – Live Search & Filter | ajax-search-lite |
| All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos | all-in-one-video-gallery |
| Anti-Spam, Spam FireWall by CleanTalk | cleantalk-spam-protect |
| Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress | latepoint |
| asVereinbase – Club & Member Management for WP | asvereinbase |
| Backup and Staging by WP Time Capsule | wp-time-capsule |
| Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots | bp-better-messages |
| BjornTech Swish for WooCommerce | woo-swish-e-commerce |
| Booking for Appointments and Events Calendar – Amelia | ameliabooking |
| Booking Package | booking-package |
| Booktics – Appointment Booking Calendar for Service Businesses | booktics |
| Brizy – Page Builder | brizy |
| Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP | videowhisper-live-streaming-integration |
| Bus Ticket Booking with Seat Reservation | bus-ticket-booking-with-seat-reservation |
| Car Rental Manager – Online Vehicle Booking System | car-rental-manager |
| Cart Abandonment Recovery for WooCommerce – Recover Lost Sales with Automated Emails | woo-cart-abandonment-recovery |
| CCAvenue Payment Gateway for WooCommerce | ccavanue-woocommerce-payment-getway |
| Chikkili- Google Pay India for Woocommerce | chikkili-google-pay-for-woocommerce |
| Classified Listing – AI-Powered Classified ads & Business Directory | classified-listing |
| Click n Chat (Chat Widget Integration) | click-n-chat |
| CMP – Coming Soon & Maintenance Plugin by NiteoThemes | cmp-coming-soon-maintenance |
| Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics | contact-form-by-supsystic |
| Contact Form Email | contact-form-to-email |
| Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe | contest-gallery |
| Datawiza Proxy Auth Plugin – SSO | reverse-proxy-auth-widget |
| Depicter — Popup & Slider Builder | depicter |
| DiviGear Carousel | dg-divi-carousel |
| Download Manager | download-manager |
| Download Monitor | download-monitor |
| Duplicator Pro | duplicator-pro |
| Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More | duplicator |
| E2Pdf – Export Pdf Tool for WordPress | e2pdf |
| Elementor Website Builder – more than just a page builder | elementor |
| eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams | eroom-zoom-meetings-webinar |
| Escape Room Booking Pro | ettrick-escape-room-booking |
| Essential Addons for Elementor – Popular Elementor Templates & Widgets | essential-addons-for-elementor-lite |
| Eurobank WooCommerce Payment Gateway | woo-payment-gateway-for-eurobank |
| Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar | mage-eventpress |
| Event Tickets and Registration | event-tickets |
| Eventer | eventer |
| Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce | wp-event-solution |
| EventON – Subscriber | eventon-subscriber |
| Events Manager – Calendar, Bookings, Tickets, Appointments and more! | events-manager |
| Extensions for Leaflet Map | extensions-leaflet-map |
| Falang multilanguage for WordPress | falang |
| Falcon – Cache, Performance, Security, Cleanup, and Tweaks | falcon |
| Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder | fluentform |
| FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler | fluent-cart |
| FluentCommunity – Ultra-Fast High-Performance Social Network, Community, LMS & Online Courses | fluent-community |
| Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder | formidable |
| Front End Users | front-end-only-users |
| GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI | gamipress |
| Geo Mashup | geo-mashup |
| GeoDirectory – WP Business Directory Plugin and Classified Listings Directory | geodirectory |
| GiveWP – Donation Plugin and Fundraising Platform | give |
| GS Pinterest Portfolio – Pins Grid, Masonry, User Profile, Popup & Board Widgets | gs-pinterest-portfolio |
| Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms | happyforms |
| HIPAA Forms | codemonkeys-hipaa-forms |
| HireZoot – Job Listings, Career Page & Recruitment Tool | wp-job-openings |
| Infility Global | infility-global |
| InstaWP Connect – 1-click WP Staging & Migration | instawp-connect |
| Interactive Content – H5P | h5p |
| Jane Menu | jane-menu |
| JetBackup – Backup, Restore & Migrate | backup |
| JetElements | jet-elements |
| Kliken: Ads + Pixel for Meta | kliken-ads-pixel-for-meta |
| Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more | knit-pay |
| LearnPress – WordPress LMS Plugin for Create and Sell Online Courses | learnpress |
| Link Library | link-library |
| LiteSpeed Cache | litespeed-cache |
| Live Summary for Gravity Forms | live-summary-for-gravity-forms |
| Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin | majestic-support |
| Mang Board | mangboard |
| MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution | marketking-multivendor-marketplace-for-woocommerce |
| MAS Videos | masvideos |
| MasterStudy LMS WordPress Plugin – for Online Courses and Education | masterstudy-lms-learning-management-system |
| MB Custom Post Types & Custom Taxonomies | mb-custom-post-type |
| Meta Box – A Framework for Dynamic Websites | meta-box |
| MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor | metform |
| miniOrange 2FA – Two Factor Authentication for WordPress (OTP, SMS, Email, Google Authenticator) | miniorange-2-factor-authentication |
| Mintpay for WooCommerce | mintpay |
| Modern Events Calendar | modern-events-calendar |
| Modern Events Calendar Lite | modern-events-calendar-lite |
| Moloni | moloni |
| ND Shortcodes | nd-shortcodes |
| News Kit Addons For Elementor | news-kit-elementor-addons |
| Newsletters | newsletters-lite |
| Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder | ninja-forms |
| Off-Canvas Sidebars & Menus (Slidebars) | off-canvas-sidebars |
| Online Payments with iK Pay Gateway | ikhokha-payment-gateway |
| OPay Payment Gateway for WooCommerce | opay-payment-gateway-for-woocommerce |
| Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE | otter-blocks |
| Page and Post Restriction | page-and-post-restriction |
| Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction | paid-member-subscriptions |
| Paid Videochat Turnkey Site – HTML5 PPV Live Webcams | ppv-live-webcams |
| Participants Database | participants-database |
| PAYDUNYA WOOCOMMERCE PAR | paydunya-woocommerce-payment-gateway |
| Payex Payment Gateway for Woocommerce | payex-payment-gateway-for-woocommerce |
| Payment Gateway for Idram | hk-idram-payment-gateway |
| Payment Gateway for Telcell | payment-gateway-for-telcell |
| Payment Gateway – nexi Alpha Bank for WooCommerce | woo-alpha-bank-payment-gateway |
| Payment Integration Wompi | payment-integration-wompi |
| Paytium: Mollie payment forms & donations | paytium |
| Photo Engine (Media Organizer & Lightroom) | wplr-sync |
| Pixel Tag Manager for WooCommerce – Google Analytics 4, Google Ads, and More Pixels | pixel-manager-for-woocommerce |
| PixelYourSite Pro – Your smart PIXEL (TAG) Manager | pixelyoursite-pro |
| PixelYourSite – Your smart PIXEL (TAG) & API Manager | pixelyoursite |
| Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred | mycred |
| Popup Builder – Create highly converting, mobile friendly marketing popups. | popup-builder |
| PowerPack Addons for Elementor: Widgets, Form Styler and Templates | powerpack-lite-for-elementor |
| Pricing Table WordPress Plugin – Easy Pricing Tables | easy-pricing-tables |
| Prime Mover – Backup and Migration | prime-mover |
| Product Filter for WooCommerce by WBW | woo-product-filter |
| Productive Commerce – Wishlist, Compare & MiniCart | productive-commerce |
| QA Assistants – Driven by data | qa-heatmap-analytics |
| Qi Addons For Elementor | qi-addons-for-elementor |
| Redirection for Contact Form 7 | wpcf7-redirect |
| Relevanssi – A Better Search | relevanssi |
| Restaurant Menu – Food Ordering System – Table Reservation | menu-ordering-reservations |
| Rootblox – Header & Footer Builder for Full Site Editing (FSE) | rootblox |
| Royal Addons for Elementor – Addons and Templates Kit for Elementor | royal-elementor-addons |
| Royal MCP – Secure AI Connector for Claude, ChatGPT & any LLM via MCP | royal-mcp |
| SchedulePress – Auto Post & Publish, Auto Social Share, Schedule Posts with Editorial Calendar & Missed Schedule Post Publisher | wp-scheduled-posts |
| Sensei LMS – Online Courses, Quizzes, & Learning | sensei-lms |
| Seriously Simple Podcasting | seriously-simple-podcasting |
| ShopMagic – email automation for WordPress | shopmagic-for-woocommerce |
| Simple Banner – Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website | simple-banner |
| Simple Shopping Cart | wordpress-simple-paypal-shopping-cart |
| SmartyParcel – DHL Express, GLS, InPost & Nova Post for WooCommerce | wc-ukr-shipping |
| Snap Finance | snap-finance-checkout |
| Social Feed Gallery | insta-gallery |
| Speed Optimizer – The All-In-One Performance-Boosting Plugin | sg-cachepress |
| Strong Testimonials | strong-testimonials |
| Subscribe to Comments | subscribe-to-comments |
| SUMIT Payment Gateway for WooCommerce | woo-payment-gateway-officeguy |
| Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers | sunshine-photo-cart |
| SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments | surecart |
| SureDash – Community, Courses & Member Dashboard | suredash |
| Surfer – WordPress Plugin | surferseo |
| Swift Performance Lite | swift-performance-lite |
| Synchrony Financing | synchrony-payments |
| Tailored Tools | tailored-tools |
| Team Members – A WordPress Team Plugin with Gallery, Grid, Carousel, Slider, Table, List, and More | gs-team-members |
| ThemeHunk Customizer | themehunk-customizer |
| TI WooCommerce Wishlist | ti-woocommerce-wishlist |
| TiendaCrypto para WooCommerce | tienda-crypto-woo |
| Translate WordPress with Weglot 2.0 – Multilingual AI Translation | weglot |
| Travelly – Tour & Travel Booking Manager for WooCommerce | tour-booking-manager |
| Uncanny Toolkit for LearnDash | uncanny-learndash-toolkit |
| UPI QR Code Payment Gateway for WooCommerce | upi-qr-code-payment-for-woocommerce |
| User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor | profile-builder |
| VikRentCar Car Rental Management System | vikrentcar |
| VOD Infomaniak | vod-infomaniak |
| W3 Total Cache | w3-total-cache |
| Waitlist Woocommerce ( Back in stock notifier ) | waitlist-woocommerce |
| Wava Payment Plugin | wava-payment |
| WebP Express | webp-express |
| weForms – Easy Drag & Drop Contact Form Builder For WordPress | weforms |
| We’re Open! | opening-hours |
| WholesaleX – Wholesale Pricing & B2B Solution | wholesalex |
| Workreap Core | workreap_core |
| WP Booking System – Booking Calendar | wp-booking-system |
| WP Mailster | wp-mailster |
| WP Stripe Checkout | wp-stripe-checkout |
| WP Ultimate Review | wp-ultimate-review |
| WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory | wp-user-manager |
| WPMobile.App – Android and iOS App Builder | wpappninja |
| WPVR – 360 Panorama viewer and Virtual Tour Builder for WordPress | wpvr |
| WPZOOM Portfolio Lite – Filterable Portfolio Plugin | wpzoom-portfolio |
| Xpro Addons — 150+ Widgets for Elementor | xpro-elementor-addons |
| YITH WooCommerce Product Bundles | yith-woocommerce-product-bundles |
| YITH WooCommerce Wishlist | yith-woocommerce-wishlist |
| ЮKassa для WooCommerce | yookassa |
WordPress Themes with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| Hallelujah | Religion & Church Charity WordPress Theme | hallelujah |
| Helion | Personal Portfolio & Agency WordPress Theme | helion |
| Holistic Center | Wellness & Spa Salon PSD Template | holistic-center |
| Hostme v2 – Responsive WordPress Theme | hostmev2 |
| HotLock | Locksmith & Security Systems WordPress Theme + RTL | hotlock |
| kallyas | kallyas |
| Little Birdies | Multipurpose Children PSD Template | little-birdies |
| redy | redy |
| Reprizo – Jewelry & Watch Store Shopify Theme | reprizo |
| Rhodos – Business Portfolio Elementor Blocks & Template Kit | rhodos |
| Save Life | Non-Profit, Charity & Donations WordPress Theme | save-life |
| Vagabonds – Travel Blog Elementor Template Kit | vagabonds |
| YOOtheme Pro | yootheme |
| Your Dress | Dress Rental & Clothing Store WordPress Theme + Shop | your-dress |
| ZenSoul – Spa Salon & Wellness WordPress Theme + Shop & AI | zensoul |
Vulnerability Details
Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.
Affected Software
Advanced Custom Fields: Extended [acf-extended]
Advanced Custom Fields: Extended PRO [acf-extended-pro]
Researcher
Advanced Custom Fields: Extended 0.9.2.7 – Unauthenticated Privilege Escalation via Account Takeover
9.8
Affected Software
Advanced Custom Fields: Extended [acf-extended]
Advanced Custom Fields: Extended PRO [acf-extended-pro]
Researcher
Affected Software
Prime Mover – Backup and Migration [prime-mover]
Researcher
Affected Software
WP Mailster [wp-mailster]
Researcher
Affected Software
Advanced Custom Fields: Extended [acf-extended]
Researcher
Affected Software
Researcher
aBlocks <= 2.17.0 – Authenticated (Contributor+) Privilege Escalation to ‘roleSlug’ Block Attribute
8.8
Affected Software
Researcher
Affected Software
Classified Listing – AI-Powered Classified ads & Business Directory [classified-listing]
Researcher
Affected Software
HIPAA Forms [codemonkeys-hipaa-forms]
Researchers
Affected Software
Duplicator Pro [duplicator-pro]
Researchers
Affected Software
Mang Board [mangboard]
Researcher
Affected Software
Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons]
Researcher
Affected Software
Uncanny Toolkit for LearnDash [uncanny-learndash-toolkit]
Researcher
Affected Software
Academist Core [academist-core]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Holistic Center | Wellness & Spa Salon PSD Template [holistic-center]
Researcher
Affected Software
Hostme v2 – Responsive WordPress Theme [hostmev2]
Researcher
Affected Software
Researcher
Little Birdies | Multipurpose Children PSD Template <= 1.3.16 – Unauthenticated PHP Object Injection
8.1
Affected Software
Little Birdies | Multipurpose Children PSD Template [little-birdies]
Researcher
Affected Software
Newsletters [newsletters-lite]
Researcher
Affected Software
Participants Database [participants-database]
Researcher
Affected Software
Researcher
Affected Software
redy [redy]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Vagabonds – Travel Blog Elementor Template Kit [vagabonds]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Ajax Search Lite – Live Search & Filter [ajax-search-lite]
Researcher
Affected Software
Booking for Appointments and Events Calendar – Amelia [ameliabooking]
Researcher
Affected Software
Click n Chat (Chat Widget Integration) [click-n-chat]
Researcher
Affected Software
Click n Chat (Chat Widget Integration) [click-n-chat]
Researcher
Affected Software
EventON – Subscriber [eventon-subscriber]
Researcher
Affected Software
Researcher
Affected Software
GS Pinterest Portfolio – Pins Grid, Masonry, User Profile, Popup & Board Widgets [gs-pinterest-portfolio]
Researcher
Affected Software
Newsletters [newsletters-lite]
Researcher
Affected Software
Participants Database [participants-database]
Researcher
Affected Software
Product Filter for WooCommerce by WBW [woo-product-filter]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
WP Mailster [wp-mailster]
Researcher
Affected Software
Advanced Custom Fields: Extended [acf-extended]
Advanced Custom Fields: Extended PRO [acf-extended-pro]
Researcher
Affected Software
Datawiza Proxy Auth Plugin – SSO [reverse-proxy-auth-widget]
Researcher
Affected Software
Researcher
Affected Software
Advanced Custom Fields: Extended [acf-extended]
Researcher
Affected Software
Anti-Spam, Spam FireWall by CleanTalk [cleantalk-spam-protect]
Researcher
Affected Software
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages]
Researcher
Affected Software
Contact Form Email [contact-form-to-email]
Researcher
Affected Software
Depicter — Popup & Slider Builder [depicter]
Researcher
Affected Software
Researcher
Affected Software
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution]
Researcher
Affected Software
Researcher
Affected Software
Hostme v2 – Responsive WordPress Theme [hostmev2]
Researcher
Affected Software
Jane Menu [jane-menu]
Researcher
Affected Software
kallyas [kallyas]
Researcher
Affected Software
LiteSpeed Cache [litespeed-cache]
Researcher
Affected Software
LiteSpeed Cache [litespeed-cache]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
PixelYourSite – Your smart PIXEL (TAG) & API Manager [pixelyoursite]
PixelYourSite Pro – Your smart PIXEL (TAG) Manager [pixelyoursite-pro]
Researcher
Affected Software
QA Assistants – Driven by data [qa-heatmap-analytics]
Researcher
Affected Software
Redirection for Contact Form 7 [wpcf7-redirect]
Researcher
Affected Software
Strong Testimonials [strong-testimonials]
Researcher
Affected Software
Researcher
Affected Software
VikRentCar Car Rental Management System [vikrentcar]
Researcher
Affected Software
VikRentCar Car Rental Management System [vikrentcar]
Researcher
Affected Software
VOD Infomaniak [vod-infomaniak]
Researcher
Affected Software
W3 Total Cache [w3-total-cache]
Researcher
Affected Software
WebP Express [webp-express]
Researcher
Affected Software
Researcher
Affected Software
WP Mailster [wp-mailster]
Researcher
Affected Software
Researcher
Affected Software
Relevanssi – A Better Search [relevanssi]
Researcher
Advanced Custom Fields: Extended 0.9.2.4 – 0.9.2.7 – Unauthenticated Arbitrary Shortcode Execution
6.5
Affected Software
Advanced Custom Fields: Extended [acf-extended]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Modern Events Calendar [modern-events-calendar]
Modern Events Calendar Lite [modern-events-calendar-lite]
Researcher
Modern Events Calendar < 7.37.0 – Authenticated (Subscriber+) SQL Injection via mec_fes_csv_export
6.5
Affected Software
Modern Events Calendar [modern-events-calendar]
Modern Events Calendar Lite [modern-events-calendar-lite]
Researcher
Affected Software
Swift Performance Lite [swift-performance-lite]
Researcher
Affected Software
WP Ultimate Review [wp-ultimate-review]
Researcher
Affected Software
Workreap Core [workreap_core]
Researcher
Affected Software
Addon Elements for Elementor (formerly Elementor Addon Elements) [addon-elements-for-elementor-page-builder]
Researcher
Affected Software
Advanced Custom Fields: Extended [acf-extended]
Advanced Custom Fields: Extended PRO [acf-extended-pro]
Researcher
Affected Software
Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution [file-manager-advanced]
Researcher
Affected Software
All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos [all-in-one-video-gallery]
Researcher
Affected Software
Brizy – Page Builder [brizy]
Researcher
Affected Software
Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe [contest-gallery]
Researcher
Affected Software
DiviGear Carousel [dg-divi-carousel]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Essential Addons for Elementor – Popular Elementor Templates & Widgets [essential-addons-for-elementor-lite]
Researcher
Affected Software
Extensions for Leaflet Map [extensions-leaflet-map]
Researcher
Affected Software
Falang multilanguage for WordPress [falang]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
JetElements [jet-elements]
Researcher
Affected Software
HireZoot – Job Listings, Career Page & Recruitment Tool [wp-job-openings]
Researcher
Affected Software
Link Library [link-library]
Researcher
Affected Software
ND Shortcodes [nd-shortcodes]
Researcher
Affected Software
Off-Canvas Sidebars & Menus (Slidebars) [off-canvas-sidebars]
Researcher
Affected Software
Researcher
Affected Software
Photo Engine (Media Organizer & Lightroom) [wplr-sync]
Researcher
Affected Software
Pixel Tag Manager for WooCommerce – Google Analytics 4, Google Ads, and More Pixels [pixel-manager-for-woocommerce]
Researcher
Affected Software
Restaurant Menu – Food Ordering System – Table Reservation [menu-ordering-reservations]
Researcher
Affected Software
Researcher
Seriously Simple Podcasting <= 3.17.0 – Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
Seriously Simple Podcasting [seriously-simple-podcasting]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Waitlist Woocommerce ( Back in stock notifier ) [waitlist-woocommerce]
Researcher
Affected Software
YITH WooCommerce Wishlist [yith-woocommerce-wishlist]
Researcher
Affected Software
HIPAA Forms [codemonkeys-hipaa-forms]
Researchers
Affected Software
Qi Addons For Elementor [qi-addons-for-elementor]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Ad Inserter – Ad Manager & AdSense Ads [ad-inserter]
Researcher
Affected Software
WP Booking System – Booking Calendar [wp-booking-system]
Researcher
Affected Software
Download Monitor [download-monitor]
Researcher
Affected Software
Eventer [eventer]
Researcher
Affected Software
Events Manager – Calendar, Bookings, Tickets, Appointments and more! [events-manager]
Researcher
Affected Software
Geo Mashup [geo-mashup]
Researcher
Affected Software
Live Summary for Gravity Forms [live-summary-for-gravity-forms]
Researcher
Affected Software
Paid Videochat Turnkey Site – HTML5 PPV Live Webcams [ppv-live-webcams]
Researcher
Affected Software
Researcher
Affected Software
ThemeHunk Customizer [themehunk-customizer]
Researcher
Affected Software
We’re Open! [opening-hours]
Researcher
Affected Software
Researcher
Affected Software
Advanced Custom Fields: Extended [acf-extended]
Researcher
Affected Software
BjornTech Swish for WooCommerce [woo-swish-e-commerce]
Researcher
Affected Software
Booking Package [booking-package]
Researcher
Affected Software
Booking Package [booking-package]
Researcher
Affected Software
Booking Package [booking-package]
Researcher
Booktics – Appointment Booking Calendar for Service Businesses <= 1.0.30 – Missing Authorization
5.3
Affected Software
Researcher
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP <= 7.3.7 – Missing Authorization
5.3
Affected Software
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP [videowhisper-live-streaming-integration]
Researcher
Affected Software
Bus Ticket Booking with Seat Reservation [bus-ticket-booking-with-seat-reservation]
Researcher
Affected Software
Cart Abandonment Recovery for WooCommerce – Recover Lost Sales with Automated Emails [woo-cart-abandonment-recovery]
Researcher
Affected Software
CCAvenue Payment Gateway for WooCommerce [ccavanue-woocommerce-payment-getway]
Researcher
Affected Software
Chikkili- Google Pay India for Woocommerce [chikkili-google-pay-for-woocommerce]
Researcher
Affected Software
Click n Chat (Chat Widget Integration) [click-n-chat]
Researcher
Affected Software
CMP – Coming Soon & Maintenance Plugin by NiteoThemes [cmp-coming-soon-maintenance]
Researcher
Affected Software
Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe [contest-gallery]
Researcher
Affected Software
Escape Room Booking Pro [ettrick-escape-room-booking]
Researcher
Affected Software
Eurobank WooCommerce Payment Gateway [woo-payment-gateway-for-eurobank]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Front End Users [front-end-only-users]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Online Payments with iK Pay Gateway [ikhokha-payment-gateway]
Researcher
Affected Software
Infility Global [infility-global]
Researchers
Affected Software
Kliken: Ads + Pixel for Meta [kliken-ads-pixel-for-meta]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
LiteSpeed Cache [litespeed-cache]
Researcher
Affected Software
Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin [majestic-support]
Researcher
Affected Software
MB Custom Post Types & Custom Taxonomies [mb-custom-post-type]
Researcher
Affected Software
Researcher
Affected Software
Mintpay for WooCommerce [mintpay]
Researcher
Affected Software
Payment Gateway – nexi Alpha Bank for WooCommerce [woo-alpha-bank-payment-gateway]
Researcher
Affected Software
OPay Payment Gateway for WooCommerce [opay-payment-gateway-for-woocommerce]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Page and Post Restriction [page-and-post-restriction]
Researcher
Affected Software
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction [paid-member-subscriptions]
Researcher
Affected Software
PAYDUNYA WOOCOMMERCE PAR [paydunya-woocommerce-payment-gateway]
Researcher
Affected Software
Payex Payment Gateway for Woocommerce [payex-payment-gateway-for-woocommerce]
Researcher
Affected Software
Payment Gateway for Idram [hk-idram-payment-gateway]
Researcher
Affected Software
Payment Gateway for Telcell [payment-gateway-for-telcell]
Researcher
Affected Software
Payment Integration Wompi [payment-integration-wompi]
Researcher
Affected Software
Researcher
Affected Software
Seriously Simple Podcasting [seriously-simple-podcasting]
Researcher
Affected Software
ShopMagic – email automation for WordPress [shopmagic-for-woocommerce]
Researcher
Affected Software
Simple Shopping Cart [wordpress-simple-paypal-shopping-cart]
Researcher
Affected Software
SmartyParcel – DHL Express, GLS, InPost & Nova Post for WooCommerce [wc-ukr-shipping]
Researcher
Affected Software
Snap Finance [snap-finance-checkout]
Researcher
Affected Software
Social Feed Gallery [insta-gallery]
Researcher
Affected Software
WP Stripe Checkout [wp-stripe-checkout]
Researcher
Affected Software
SUMIT Payment Gateway for WooCommerce [woo-payment-gateway-officeguy]
Researchers
Affected Software
Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers [sunshine-photo-cart]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Synchrony Financing [synchrony-payments]
Researcher
Affected Software
TI WooCommerce Wishlist [ti-woocommerce-wishlist]
Researcher
Affected Software
TiendaCrypto para WooCommerce [tienda-crypto-woo]
Researcher
Affected Software
Travelly – Tour & Travel Booking Manager for WooCommerce [tour-booking-manager]
Researcher
Affected Software
UPI QR Code Payment Gateway for WooCommerce [upi-qr-code-payment-for-woocommerce]
Researcher
Affected Software
Wava Payment Plugin [wava-payment]
Affected Software
Wava Payment Plugin [wava-payment]
Affected Software
WholesaleX – Wholesale Pricing & B2B Solution [wholesalex]
Researcher
Affected Software
WholesaleX – Wholesale Pricing & B2B Solution [wholesalex]
Researcher
Affected Software
WPMobile.App – Android and iOS App Builder [wpappninja]
Researcher
Affected Software
YITH WooCommerce Product Bundles [yith-woocommerce-product-bundles]
Researcher
Affected Software
ЮKassa для WooCommerce [yookassa]
Researcher
Affected Software
Researcher
Affected Software
Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics [contact-form-by-supsystic]
Researcher
Affected Software
Speed Optimizer – The All-In-One Performance-Boosting Plugin [sg-cachepress]
Researcher
Affected Software
Advanced Twenty Seventeen [advanced-twenty-seventeen]
Researcher
Affected Software
Backup and Staging by WP Time Capsule [wp-time-capsule]
Researcher
Affected Software
Car Rental Manager – Online Vehicle Booking System [car-rental-manager]
Researcher
Affected Software
Download Manager [download-manager]
Researcher
Affected Software
Pricing Table WordPress Plugin – Easy Pricing Tables [easy-pricing-tables]
Researcher
Affected Software
eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams [eroom-zoom-meetings-webinar]
Researcher
Affected Software
eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams [eroom-zoom-meetings-webinar]
Researcher
Affected Software
Event Tickets and Registration [event-tickets]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
InstaWP Connect – 1-click WP Staging & Migration [instawp-connect]
Researcher
Interactive Content – H5P <= 1.17.9 – Authenticated (Contributor+) Insecure Direct Object Reference
4.3
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
LiteSpeed Cache [litespeed-cache]
Researcher
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution <= 2.1.72 – Missing Authorization
4.3
Affected Software
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution [marketking-multivendor-marketplace-for-woocommerce]
Researcher
Affected Software
MAS Videos [masvideos]
Researcher
Affected Software
MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system]
Researcher
Affected Software
MB Custom Post Types & Custom Taxonomies [mb-custom-post-type]
Researcher
Affected Software
Meta Box – A Framework for Dynamic Websites [meta-box]
Researcher
Affected Software
miniOrange 2FA – Two Factor Authentication for WordPress (OTP, SMS, Email, Google Authenticator) [miniorange-2-factor-authentication]
Researcher
Affected Software
Moloni [moloni]
Researcher
Affected Software
News Kit Addons For Elementor [news-kit-elementor-addons]
Researcher
Affected Software
News Kit Addons For Elementor [news-kit-elementor-addons]
Researcher
Participants Database <= 2.7.8.5 – Authenticated (Contributor+) Insecure Direct Object Reference
4.3
Affected Software
Participants Database [participants-database]
Researcher
Affected Software
Photo Engine (Media Organizer & Lightroom) [wplr-sync]
Researcher
Affected Software
Researcher
Affected Software
PowerPack Addons for Elementor: Widgets, Form Styler and Templates [powerpack-lite-for-elementor]
Researcher
Affected Software
Productive Commerce – Wishlist, Compare & MiniCart [productive-commerce]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Sensei LMS – Online Courses, Quizzes, & Learning [sensei-lms]
Researcher
Affected Software
Sensei LMS – Online Courses, Quizzes, & Learning [sensei-lms]
Researcher
Affected Software
Simple Shopping Cart [wordpress-simple-paypal-shopping-cart]
Researcher
Affected Software
SmartyParcel – DHL Express, GLS, InPost & Nova Post for WooCommerce [wc-ukr-shipping]
Researcher
Affected Software
Strong Testimonials [strong-testimonials]
Researcher
Affected Software
Subscribe to Comments [subscribe-to-comments]
Researcher
Affected Software
Researcher
Affected Software
Surfer – WordPress Plugin [surferseo]
Researcher
Affected Software
Tailored Tools [tailored-tools]
Researcher
Affected Software
VikRentCar Car Rental Management System [vikrentcar]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
WPZOOM Portfolio Lite – Filterable Portfolio Plugin [wpzoom-portfolio]
Researcher
Affected Software
Xpro Addons — 150+ Widgets for Elementor [xpro-elementor-addons]
Researcher
Affected Software
Researcher
Affected Software
Download Monitor [download-monitor]
Researcher
Affected Software
Essential Addons for Elementor – Popular Elementor Templates & Widgets [essential-addons-for-elementor-lite]
Researcher
Affected Software
Speed Optimizer – The All-In-One Performance-Boosting Plugin [sg-cachepress]
Researcher
Affected Software
Uncanny Toolkit for LearnDash [uncanny-learndash-toolkit]
Researcher
Affected Software
Researcher
As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.
This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
The post Wordfence Intelligence Weekly WordPress Vulnerability Report (October 19, 2026 to October 25, 2026) appeared first on Wordfence.
