Wordfence Intelligence Weekly WordPress Vulnerability Report (June 9, 2025 to June 15, 2025)

by

📢 Calling all Vulnerability Researchers and Bug Bounty Hunters! 📢 

🌞 Spring into Summer with Wordfence! Now through August 4, 2025, earn 2X bounty rewards for all in-scope submissions from our ‘High Threat’ list in software with fewer than 5 million active installs. Bounties up to $31,200 per vulnerability. Submit bold. Earn big!

Last week, there were 137 vulnerabilities disclosed in 101 WordPress Plugins and 32 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 52 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back.

Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 27,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

New Firewall Rules Deployed Last Week

The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.

The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:

  • PayU CommercePro Plugin <= 3.8.5 – Authentication Bypass
  • WAF-RULE-845 – Data redacted while we work with the vendor on a patch.
  • WAF-RULE-846 – Data redacted while we work with the vendor on a patch.
  • WAF-RULE-847 – Data redacted while we work with the vendor on a patch.
  • WAF-RULE-848 – Data redacted while we work with the vendor on a patch.
  • WAF-RULE-852 – Data redacted while we work with the vendor on a patch.

Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.

Total Unpatched & Patched Vulnerabilities Last Week

Patch Status Number of Vulnerabilities
Patched 74
Unpatched 63

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating Number of Vulnerabilities
Medium Severity 72
High Severity 30
Critical Severity 35

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE Number of Vulnerabilities
Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) 42
Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’) 29
Cross-Site Request Forgery (CSRF) 12
Missing Authorization 11
Unrestricted Upload of File with Dangerous Type 11
Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) 10
Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) 6
Deserialization of Untrusted Data 5
Improper Privilege Management 4
Absolute Path Traversal 1
Authentication Bypass Using an Alternate Path or Channel 1
Exposure of Sensitive Information to an Unauthorized Actor 1
Improper Control of Generation of Code (‘Code Injection’) 1
Incorrect Authorization 1
Server-Side Request Forgery (SSRF) 1
URL Redirection to Untrusted Site (‘Open Redirect’) 1

Researchers That Contributed to WordPress Security Last Week

Researcher Name Number of Vulnerabilities
19
9
9
8
7
7
6
6
4
4
3
3
3
3
2
2
2
2
2
2
2
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name Software Slug
Abandoned Cart Pro for WooCommerce woocommerce-abandon-cart-pro
ACF Onyx Poll acf-onyx-poll
Advanced Sermons advanced-sermons
Advanced Settings 3 advanced-settings
Aeroscroll Gallery – Infinite Scroll Image Gallery & Post Grid with Photo Gallery aeroscroll-gallery
AFS Analytics addfreestats
AI Image Lab – Free AI Image Generator ai-image-generator-lab
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin simply-schedule-appointments
Arconix FAQ arconix-faq
Arconix Shortcodes arconix-shortcodes
Auto Attachments auto-attachments
AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress automatorwp
Axle Demo Importer axle-demo-importer
Bunny’s Print CSS bunnys-print-css
CLEVER – HTML5 Radio Player With History – Shoutcast and Icecast – WordPress Plugin lbg-audio11-html5-shoutcast_history
Click to Chat – HoliThemes click-to-chat-for-whatsapp
Color Palette color-palette
Contact Us Page – Contact People contact-us-page-contact-people
CubeWP Forms – All-in-One Form Builder cubewp-forms
CubeWP – All-in-One Dynamic Content Framework cubewp-framework
Digital Marketing and Agency Templates Addons for Elementor digital-marketing-agency-templates-for-elementor
DIOT SCADA with MQTT ecava-diot-scada
Easy Flashcards easy-flashcards
Ebook Store ebook-store
eForm – WordPress Form Builder wp-fsqm-pro
Elementor Website Builder Pro elementor-pro
Elite Video Player elite-video-player
File Manager Pro – Filester filester
FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce wp-marketing-automations
FW Food Menu – Responsive food menu with ordering & delivery solutions fw-food-menu
FW Gallery – Photo, video, audio media presentation and management system with players and slideshow fw-gallery
Game Review Block game-review-block
If-So Dynamic Content Personalization if-so
Image Resizer On The Fly image-resizer-on-the-fly
IndieBlocks indieblocks
IRM Newsroom irm-newsroom
Kama Click Counter kama-clic-counter
kk Youtube Video kk-youtube-video
Link Shield link-shield
Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin majestic-support
Malcure Malware Scanner — Toolset for WordPress Malware Removal wp-malware-removal
MapSVG mapsvg
Meks Flexible Shortcodes meks-flexible-shortcodes
Membership For WooCommerce membership-for-woocommerce
myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program. mycred
Nasa Core nasa-core
One-Login one-login
Ovatheme Events Manager ova-events-manager
PostaPanduri postapanduri
Premium Addons for Elementor premium-addons-for-elementor
ProfileGrid – User Profiles, Groups and Communities profilegrid-user-profiles-groups-and-communities
ReFormer – Multichannel Contact Form for Elementor reformer-elementor
Responsive Blocks – WordPress Gutenberg Blocks responsive-block-editor-addons
Responsive Plus – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme. responsive-add-ons
REST API | Custom API Generator For Cross Platform And Import Export In WP import-export-with-custom-rest-api
Restrict File Access restrict-file-access
School Management System for WordPress school-management
Simple Newsletter Plugin – Noptin newsletter-optin-box
Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider ml-slider
Slim SEO – Fast & Automated WordPress SEO Plugin slim-seo
Smart Notification WordPress Plugin. Web & Mobile Push, FB Messenger, FB Notifications & Newsletter. smio-push-notification
Smash Balloon Social Post Feed – Simple Social Feeds for WordPress custom-facebook-feed
StreamWeasels Kick Integration streamweasels-kick-integration
Telegram for WP telegram-for-wp
The Events Calendar the-events-calendar
TicketBAI Facturas para WooCommerce wp-ticketbai
Track, Analyze & Optimize by WP Tao wp-tao
Traffic Monitor traffic-monitor
Ultimate Blocks – WordPress Blocks Plugin ultimate-blocks
Ultimate Reviews ultimate-reviews
UserPro – Community and User Profile WordPress Plugin userpro
Widget Logic widget-logic
WidgetKit Pro widgetkit-pro
Woocommerce Partial Shipment wc-partial-shipment
WordPress Automatic Plugin wp-automatic
WordPress Single Sign-On (SSO) – Multisite All-Inclusive miniorange-oauth-oidc-single-sign-on
WordPress Single Sign-On (SSO) – Multisite Enterprise miniorange-oauth-oidc-single-sign-on
WordPress Single Sign-On (SSO) – Multisite Premium miniorange-oauth-oidc-single-sign-on
WordPress Single Sign-On (SSO) – Single Site All-Inclusive miniorange-oauth-oidc-single-sign-on
WordPress Single Sign-On (SSO) – Single Site Enterprise miniorange-oauth-oidc-single-sign-on
WordPress Single Sign-On (SSO) – Single Site Premium miniorange-oauth-oidc-single-sign-on
WordPress Single Sign-On (SSO) – Single Site Standard miniorange-oauth-oidc-single-sign-on
Workreap workreap
WP Employee Attendance System wp-employee-attendance-system
WP Job Portal – A Complete Recruitment System for Company or Job Board website wp-job-portal
WP Sliding Login/Dashboard Panel wp-sliding-logindashboard-panel
WP Travel Engine – Tour Booking Plugin – Tour Operator Software wp-travel-engine
WP URL Shortener wp-url-shortener
WP Views Counter wpecounter
WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress wpvr
WP-DownloadManager wp-downloadmanager
WP2HTML wp2html
WPAdverts – Classifieds Plugin wpadverts
WPCRM – CRM for Contact form CF7 & WooCommerce wpcrm
WPGYM – WordPress Gym Management System gym-management
Xagio SEO – AI Powered SEO xagio-seo
XiSearch bar xisearch-bar
YITH WooCommerce Wishlist yith-woocommerce-wishlist
Yougler Blogger Profile Page yougler-blogger-profile-page
Zen Sticky Social zen-social-sticky
Zotpress zotpress

WordPress Themes with Reported Vulnerabilities Last Week

Software Name Software Slug
Aora – Home & Lifestyle Elementor WooCommerce Theme aora
Besa – Elementor Marketplace WooCommerce Theme besa
BodyCenter – Gym, Fitness WooCommerce WordPress Theme bodycenter
CozyStay – Hotel Booking WordPress Theme cozystay
CraftXtore – Handmade, Ceramics and Pottery Shop WooCommerce Theme bw-craftxtore
Diza – Pharmacy Store Elementor WooCommerce Theme diza
edmin edmin
Evon – Bag Store WooCommerce WordPress Theme snsevon
Fana – Fashion Shop WordPress Theme fana
Fitrush – Fitness and Health Supplements WordPress Theme bw-fitrush
Flozen – WooCommerce AJAX WordPress RTL Theme flozen-theme
GiftXtore – Luxury Jewelry & Gift Store Elementor WooCommerce WordPress Theme bw-giftxtore
GrandPrix – Motorcycle WordPress Theme grandprix
Hara – Beauty and Cosmetics Shop WooCommerce Theme hara
Inset – Digital Agency & IT Services WordPress Theme inset
Lasa – Creative Minimal WooCommerce WordPress Theme lasa
Maia – Jewelry Shop WordPress Theme maia
MediClinic – Medical Healthcare WordPress Theme mediclinic
Nika – Medical Elementor WooCommerce Theme nika
Nitan – Fashion WooCommerce WordPress Theme snsnitan
Petito – Animals and Pets Store WooCommerce Theme bw-petito
Photography photography
RH – Real Estate WordPress Theme realhomes
Ruza – Beauty Cosmetics Shop WordPress Theme ruza
Sapa – Product Landing Page WooCommerce Theme sapa
Simen – MultiPurpose WooCommerce WordPress Theme snssimen
SNS Anton – Furniture WooCommerce WordPress Theme snsanton
Spare – Ultimate MultiPurpose LESS Theme spare
TinySalt – Personal Food Blog WordPress Theme tinysalt
Valen – Sport, Fashion WooCommerce WordPress Theme valen
Zagg – Electronics & Accessories WooCommerce WordPress Theme bw-zagg
Zota – Elementor Multi-Purpose WooCommerce Theme zota

Vulnerability Details

Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.

Aora <= 1.3.9 – Unauthenticated Local File Inclusion

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-49260
Patch Status
Patched
Published
Jun 11, 2025
Affected Software
Aora – Home & Lifestyle Elementor WooCommerce Theme
Researcher
More Details >

Besa <= 2.3.8 – Unauthenticated Local File Inclusion

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-49252
Patch Status
Patched
Published
Jun 11, 2025
Affected Software
Besa – Elementor Marketplace WooCommerce Theme
Researcher
More Details >

BodyCenter – Gym, Fitness WooCommerce WordPress Theme <= 2.4 – Unauthenticated Local File Inclusion

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2023-25999
Patch Status
Unpatched
Published
Jun 9, 2025
Affected Software
BodyCenter – Gym, Fitness WooCommerce WordPress Theme
Researcher
More Details >

CozyStay < 1.7.1 – Unauthenticated Local File Inclusion

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-49508
Patch Status
Patched
Published
Jun 11, 2025
Affected Software
CozyStay – Hotel Booking WordPress Theme
Researcher
More Details >

CozyStay < 1.7.1 – Unauthenticated PHP Object Injection

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-49507
Patch Status
Patched
Published
Jun 9, 2025
Affected Software
CozyStay – Hotel Booking WordPress Theme
Researcher
More Details >

CraftXtore <= 1.7 – Unauthenticated Local File Inclusion

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-24770
Patch Status
Unpatched
Published
Jun 9, 2025
Affected Software
CraftXtore – Handmade, Ceramics and Pottery Shop WooCommerce Theme
Researcher
More Details >

Diza <= 1.3.8 – Unauthenticated Local File Inclusion

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-49261
Patch Status
Patched
Published
Jun 11, 2025
Affected Software
Diza – Pharmacy Store Elementor WooCommerce Theme
Researcher
More Details >

Evon <= 3.4 – Unauthenticated Local File Inclusion

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-28991
Patch Status
Unpatched
Published
Jun 11, 2025
Affected Software
Evon – Bag Store WooCommerce WordPress Theme
Researcher
More Details >

Fana <= 1.1.28 – Unauthenticated Local File Inclusion

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-49251
Patch Status
Patched
Published
Jun 11, 2025
Affected Software
Fana – Fashion Shop WordPress Theme
Researcher
More Details >

Fitrush <= 1.3.4 – Unauthenticated Local File Inclusion

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2023-26005
Patch Status
Unpatched
Published
Jun 9, 2025
Affected Software
Fitrush – Fitness and Health Supplements WordPress Theme
Researcher
More Details >

Flozen < 1.5.1 – Unauthenticated Arbitrary File Upload

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-49071
Patch Status
Patched
Published
Jun 11, 2025
Affected Software
Flozen – WooCommerce AJAX WordPress RTL Theme
Researcher
More Details >

FW Food Menu <= 6.0.0 – Unauthenticated Arbitrary File Upload

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-49447
Patch Status
Unpatched
Published
Jun 12, 2025
Affected Software
FW Food Menu – Responsive food menu with ordering & delivery solutions
Researcher
More Details >

GiftXtore <= 1.7.4 – Unauthenticated Local File Inclusion

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-28888
Patch Status
Unpatched
Published
Jun 9, 2025
Affected Software
GiftXtore – Luxury Jewelry & Gift Store Elementor WooCommerce WordPress Theme
Researcher
More Details >

GrandPrix <= 1.6 – Unauthenticated Local File Inclusion

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-49296
Patch Status
Patched
Published
Jun 9, 2025
Affected Software
GrandPrix – Motorcycle WordPress Theme
Researcher
More Details >

Hara <= 1.2.10 – Unauthenticated Local File Inclusion

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-49259
Patch Status
Patched
Published
Jun 11, 2025
Affected Software
Hara – Beauty and Cosmetics Shop WooCommerce Theme
Researcher
More Details >

Inset <= 1.18.0 – Unauthenticated Local File Inclusion

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-26592
Patch Status
Unpatched
Published
Jun 9, 2025
Affected Software
Inset – Digital Agency & IT Services WordPress Theme
Researcher
More Details >

Lasa <= 1.1 – Unauthenticated Local File Inclusion

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-49253
Patch Status
Patched
Published
Jun 11, 2025
Affected Software
Lasa – Creative Minimal WooCommerce WordPress Theme
Researcher
More Details >

Maia <= 1.1.15 – Unauthenticated Local File Inclusion

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-49258
Patch Status
Patched
Published
Jun 11, 2025
Affected Software
Maia – Jewelry Shop WordPress Theme
Researcher
More Details >

MediClinic <= 2.1 – Unauthenticated Local File Inclusion

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-49295
Patch Status
Patched
Published
Jun 9, 2025
Affected Software
MediClinic – Medical Healthcare WordPress Theme
Researcher(s): Unknown
More Details >

Nika <= 1.2.8 – Unauthenticated Local File Inclusion

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-49254
Patch Status
Patched
Published
Jun 11, 2025
Affected Software
Nika – Medical Elementor WooCommerce Theme
Researcher
More Details >

Nitan <= 2.9 – Unauthenticated Local File Inclusion

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-24768
Patch Status
Unpatched
Published
Jun 9, 2025
Affected Software
Nitan – Fashion WooCommerce WordPress Theme
Researcher
More Details >

One-Login <= 1.4 – Unauthenticated Privilege Esclation

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-23974
Patch Status
Unpatched
Published
Jun 9, 2025
Affected Software
One-Login
Researcher
More Details >

Ovatheme Events Manager <= 1.7.5 – Unauthenticated Arbitrary File Upload

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-32510
Patch Status
Unpatched
Published
Jun 11, 2025
Affected Software
Ovatheme Events Manager
Researcher
More Details >

Petito <= 1.6.2 – Unauthenticated Local File Inclusion

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-27362
Patch Status
Unpatched
Published
Jun 9, 2025
Affected Software
Petito – Animals and Pets Store WooCommerce Theme
Researcher
More Details >

Reformer for Elementor <= 1.0.5 – Unauthenticated Arbitrary File Upload

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-49444
Patch Status
Unpatched
Published
Jun 11, 2025
Affected Software
ReFormer – Multichannel Contact Form for Elementor
Researcher
More Details >

REST API | Custom API Generator For Cross Platform And Import Export In WP 1.0.0 – 2.0.3 – Missing Authorization to Unauthenticated Privilege Escalation via process_handler Function

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-5288
Patch Status
Unpatched
Published
Jun 12, 2025
Affected Software
REST API | Custom API Generator For Cross Platform And Import Export In WP
Researcher
More Details >

Ruza <= 1.0.7 – Unauthenticated Local File Inclusion

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-49255
Patch Status
Patched
Published
Jun 11, 2025
Affected Software
Ruza – Beauty Cosmetics Shop WordPress Theme
Researcher
More Details >

Sapa <= 1.1.14 – Unauthenticated Local File Inclusion

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-49256
Patch Status
Patched
Published
Jun 11, 2025
Affected Software
Sapa – Product Landing Page WooCommerce Theme
Researcher
More Details >

Simen <= 4.6 – Unauthenticated Local File Inclusion

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-29002
Patch Status
Unpatched
Published
Jun 11, 2025
Affected Software
Simen – MultiPurpose WooCommerce WordPress Theme
Researcher
More Details >

SNS Anton <= 4.1 – Unauthenticated Local File Inclusion

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-28992
Patch Status
Unpatched
Published
Jun 9, 2025
Affected Software
SNS Anton – Furniture WooCommerce WordPress Theme
Researcher
More Details >

Valen – Sport, Fashion WooCommerce WordPress Theme <= 2.4 – Unauthenticated Local File Inclusion

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-28945
Patch Status
Unpatched
Published
Jun 9, 2025
Affected Software
Valen – Sport, Fashion WooCommerce WordPress Theme
Researcher
More Details >

Workreap <= 3.3.1 – Authentication Bypass via ‘workreap_verify_user_account’

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-4973
Patch Status
Patched
Published
Jun 11, 2025
Affected Software
Workreap
Researcher
More Details >

Zota <= 1.3.8 – Unauthenticated Local File Inclusion

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-49257
Patch Status
Patched
Published
Jun 11, 2025
Affected Software
Zota – Elementor Multi-Purpose WooCommerce Theme
Researcher
More Details >

FW Gallery <= 8.0.0 – Unauthenticated Arbitrary File Deletion

9.1
CVSS Rating
Critical (9.1)
CVE-ID
CVE-2025-49415
Patch Status
Unpatched
Published
Jun 10, 2025
Affected Software
FW Gallery – Photo, video, audio media presentation and management system with players and slideshow
Researcher
More Details >

Image Resizer On The Fly <= 1.1 – Unauthenticated Arbitrary File Deletion

9.1
CVSS Rating
Critical (9.1)
CVE-ID
CVE-2025-6065
Patch Status
Unpatched
Published
Jun 13, 2025
Affected Software
Image Resizer On The Fly
Researcher
More Details >

Abandoned Cart Pro for WooCommerce <= 9.16.0 – Authenticated (Subscriber+) Arbitrary File Upload

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-4387
Patch Status
Patched
Published
Jun 9, 2025
Affected Software
Abandoned Cart Pro for WooCommerce
Researcher
More Details >

Axle Demo Importer <= 1.0.3 – Authenticated (Author+) Arbitrary File Upload

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-4954
Patch Status
Unpatched
Published
Jun 11, 2025
Affected Software
Axle Demo Importer
Researcher
More Details >

CubeWP – All-in-One Dynamic Content Framework <= 1.1.23 – Authenticated (Subscriber+) Privilege Escalation

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-4315
Patch Status
Patched
Published
Jun 10, 2025
Affected Software
CubeWP – All-in-One Dynamic Content Framework
Researcher
More Details >

MapSVG <= 8.5.32 – Authenticated (Contributor+) Arbitrary File Upload

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-47559
Patch Status
Unpatched
Published
Jun 12, 2025
Affected Software
MapSVG
Researcher
More Details >

MapSVG <= 8.5.34 – Authenticated (Contributor+) Privilege Esclation

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-47561
Patch Status
Unpatched
Published
Jun 9, 2025
Affected Software
MapSVG
Researcher
More Details >

RH – Real Estate WordPress Theme <= 4.4.0 – Authenticated (Subscriber+) Privilege Escalation

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-4601
Patch Status
Patched
Published
Jun 9, 2025
Affected Software
RH – Real Estate WordPress Theme
Researcher
More Details >

School Management <= 93.0.0 – Authenticated (Student+) Local File Inclusion

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-47572
Patch Status
Unpatched
Published
Jun 12, 2025
Affected Software
School Management System for WordPress
Researcher
More Details >

Themify Edmin <= 2.0.0 – Authenticated (Contributor+) PHP Object Injection

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-31047
Patch Status
Unpatched
Published
Jun 9, 2025
Affected Software
edmin
Researcher
More Details >

Widget Logic <= 6.0.5 – Authenticated (Contributor+) Remote Code Execution

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-32222
Patch Status
Unpatched
Published
Jun 9, 2025
Affected Software
Widget Logic
Researcher
More Details >

WordPress Automatic Plugin – AI content generator and auto poster plugin <= 3.115.0 – Authenticated (Author+) Arbitrary File Upload

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-5395
Patch Status
Patched
Published
Jun 10, 2025
Affected Software
WordPress Automatic Plugin
Researcher
More Details >

Workreap <= 3.3.2 – Authenticated (Subscriber+) Arbitrary File Upload via ‘workreap_temp_upload_to_media’

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-5012
Patch Status
Patched
Published
Jun 11, 2025
Affected Software
Workreap
Researcher
More Details >

WP VR <= 8.5.26 – Authenticated (Contributor+) Arbitrary File Upload

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-47452
Patch Status
Patched
Published
Jun 12, 2025
Affected Software
WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress
Researcher
More Details >

WPGYM <= 65.0 – Authenticated (Subscriber+) Local File Inclusion

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-32549
Patch Status
Unpatched
Published
Jun 12, 2025
Affected Software
WPGYM – WordPress Gym Management System
Researcher
More Details >

Photography <= 7.5.2 – Unauthenticated PHP Object Injection

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2025-47579
Patch Status
Unpatched
Published
Jun 10, 2025
Affected Software
Photography
Researcher
More Details >

Spare <= 1.7 – Unauthenticated PHP Object Injection

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2025-31919
Patch Status
Unpatched
Published
Jun 10, 2025
Affected Software
Spare – Ultimate MultiPurpose LESS Theme
Researcher
More Details >

TinySalt < 3.10.0 – Unauthenticated Local File Inclusion

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2025-49454
Patch Status
Patched
Published
Jun 9, 2025
Affected Software
TinySalt – Personal Food Blog WordPress Theme
Researcher
More Details >

TinySalt < 3.10.0 – Unauthenticated PHP Object Injection

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2025-49455
Patch Status
Patched
Published
Jun 9, 2025
Affected Software
TinySalt – Personal Food Blog WordPress Theme
Researcher
More Details >

Zagg – Electronics & Accessories WooCommerce WordPress Theme <= 1.4.1 – Unauthenticated Local File Inclusion

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2025-4200
Patch Status
Unpatched
Published
Jun 13, 2025
Affected Software
Zagg – Electronics & Accessories WooCommerce WordPress Theme
Researcher
More Details >

CLEVER <= 2.6 – Unauthenticated Arbitrary File Download

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2025-31635
Patch Status
Unpatched
Published
Jun 9, 2025
Affected Software
CLEVER – HTML5 Radio Player With History – Shoutcast and Icecast – WordPress Plugin
Researcher
More Details >

PostaPanduri <= 2.1.3 – Unauthenticated SQL Injection

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2025-49452
Patch Status
Unpatched
Published
Jun 12, 2025
Affected Software
PostaPanduri
Researcher
More Details >

School Management <= 92.0.0 – Unauthenticated SQL Injection

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2025-47573
Patch Status
Unpatched
Published
Jun 11, 2025
Affected Software
School Management System for WordPress
Researcher
More Details >

Smart Notification <= 10.3 – Unauthenticated SQL Injection

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2025-39479
Patch Status
Unpatched
Published
Jun 11, 2025
Affected Software
Smart Notification WordPress Plugin. Web & Mobile Push, FB Messenger, FB Notifications & Newsletter.
Researcher
More Details >

TicketBAI Facturas para WooCommerce <= 3.19 – Unauthenticated SQL Injection

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2025-24767
Patch Status
Patched
Published
Jun 9, 2025
Affected Software
TicketBAI Facturas para WooCommerce
Researcher
More Details >

WP Job Portal <= 2.3.2 – Unauthenticated SQL Injection

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2025-48274
Patch Status
Patched
Published
Jun 11, 2025
Affected Software
WP Job Portal – A Complete Recruitment System for Company or Job Board website
Researcher
More Details >

WP Travel Engine <= 6.5.1 – Missing Authorization to Unauthenticated Arbitrary Post Deletion

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2025-5282
Patch Status
Patched
Published
Jun 12, 2025
Affected Software
WP Travel Engine – Tour Booking Plugin – Tour Operator Software
Researcher
More Details >

WPCRM – CRM for Contact form CF7 & WooCommerce <= 3.2.0 – Unauthenticated SQL Injection

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2025-24773
Patch Status
Unpatched
Published
Jun 12, 2025
Affected Software
WPCRM – CRM for Contact form CF7 & WooCommerce
Researcher
More Details >

AutomatorWP <= 5.2.5 – Authenticated (Administrator+) SQL Injection via field_conditions

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2025-5487
Patch Status
Patched
Published
Jun 13, 2025
Affected Software
AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress
Researcher
More Details >

File Manager Pro – Filester <= 1.8.8 – Authenticated (Administrator+) Arbitrary File Upload

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2025-3234
Patch Status
Patched
Published
Jun 13, 2025
Affected Software
File Manager Pro – Filester
Researcher
More Details >

WP-DownloadManager <= 1.68.10 – Authenticated (Administrator+) Arbitrary File Deletion

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2025-4799
Patch Status
Patched
Published
Jun 10, 2025
Affected Software
WP-DownloadManager
Researcher
More Details >

Xagio SEO <= 7.1.0.16 – Unauthenticated Stored Cross-Site Scripting via ‘HTTP_REFERER’

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2025-3302
Patch Status
Patched
Published
Jun 10, 2025
Affected Software
Xagio SEO – AI Powered SEO
Researcher
More Details >

Malcure Malware Scanner — #1 Toolset for WordPress Malware Removal <= 16.8 – Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read

6.5
CVSS Rating
Medium (6.5)
CVE-ID
Unknown
Patch Status
Patched
Published
Jun 12, 2025
Affected Software
Malcure Malware Scanner — #1 Toolset for WordPress Malware Removal
Researcher
More Details >

Restrict File Access <= 1.1.2 – Authenticated (Subscriber+) Arbitrary File Read

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2025-6070
Patch Status
Unpatched
Published
Jun 13, 2025
Affected Software
Restrict File Access
Researcher
More Details >

Woocommerce Partial Shipment <= 3.2 – Authenticated (Subscriber+) SQL Injection

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2025-48118
Patch Status
Unpatched
Published
Jun 11, 2025
Affected Software
Woocommerce Partial Shipment
Researcher
More Details >

ACF Onyx Poll <= 1.1.9 – Authenticated (Contributor+) Stored Cross-Site Scripting via class Parameter

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-5841
Patch Status
Patched
Published
Jun 12, 2025
Affected Software
ACF Onyx Poll
Researcher
More Details >

Advanced Sermons <= 3.6 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-49863
Patch Status
Patched
Published
Jun 12, 2025
Affected Software
Advanced Sermons
Researcher
More Details >

Arconix Shortcodes <= 2.1.17 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-49858
Patch Status
Patched
Published
Jun 12, 2025
Affected Software
Arconix Shortcodes
Researcher
More Details >

Click to Chat <= 4.22 – Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via data-no_number Parameter

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-5336
Patch Status
Patched
Published
Jun 13, 2025
Affected Software
Click to Chat – HoliThemes
Researcher
More Details >

Color Palette <= 4.3.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via hex Parameter

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-5233
Patch Status
Unpatched
Published
Jun 12, 2025
Affected Software
Color Palette
Researcher
More Details >

Contact Us Page – Contact People <= 3.7.4 – Authenticated (Contributor+) Stored Cross-Site Scripting via style Parameter

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-5123
Patch Status
Unpatched
Published
Jun 12, 2025
Affected Software
Contact Us Page – Contact People
Researcher
More Details >

CubeWP Framework <= 1.1.23 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-49882
Patch Status
Patched
Published
Jun 12, 2025
Affected Software
CubeWP – All-in-One Dynamic Content Framework
Researcher
More Details >

DIOT SCADA with MQTT <= 1.0.5.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-4216
Patch Status
Unpatched
Published
Jun 13, 2025
Affected Software
DIOT SCADA with MQTT
Researcher
More Details >

Elementor Pro <= 3.29.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-3076
Patch Status
Patched
Published
Jun 9, 2025
Affected Software
Elementor Website Builder Pro
Researcher
More Details >

Game Review Block <= 4.8.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via className Parameter

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-5923
Patch Status
Patched
Published
Jun 12, 2025
Affected Software
Game Review Block
Researcher
More Details >

If-So Dynamic Content Personalization <= 1.9.3.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-49875
Patch Status
Patched
Published
Jun 12, 2025
Affected Software
If-So Dynamic Content Personalization
Researcher
More Details >

IndieBlocks <= 0.13.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via kind Parameter

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-5950
Patch Status
Patched
Published
Jun 12, 2025
Affected Software
IndieBlocks
Researcher
More Details >

IRM Newsroom <= 1.2.17 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘irmcalendarview’ Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-4586
Patch Status
Unpatched
Published
Jun 12, 2025
Affected Software
IRM Newsroom
Researcher
More Details >

IRM Newsroom <= 1.2.17 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘irmeventlist’ Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-4584
Patch Status
Unpatched
Published
Jun 12, 2025
Affected Software
IRM Newsroom
Researcher
More Details >

IRM Newsroom <= 1.2.17 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘irmflat’ Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-4585
Patch Status
Unpatched
Published
Jun 12, 2025
Affected Software
IRM Newsroom
Researcher
More Details >

Kama Click Counter <= 4.0.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-49861
Patch Status
Patched
Published
Jun 12, 2025
Affected Software
Kama Click Counter
Researcher
More Details >

kk Youtube Video <= 0.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-6061
Patch Status
Unpatched
Published
Jun 13, 2025
Affected Software
kk Youtube Video
Researcher
More Details >

Meks Flexible Shortcodes <= 1.3.7 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-49855
Patch Status
Patched
Published
Jun 12, 2025
Affected Software
Meks Flexible Shortcodes
Researcher
More Details >

Premium Addons for Elementor <= 4.11.8 – Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-4774
Patch Status
Patched
Published
Jun 9, 2025
Affected Software
Premium Addons for Elementor
Researcher
More Details >

ProfileGrid <= 5.9.5.2 – Authenticated (Subscriber+) Server-Side Request Forgery

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-49877
Patch Status
Patched
Published
Jun 12, 2025
Affected Software
ProfileGrid – User Profiles, Groups and Communities
Researcher
More Details >

Responsive Blocks <= 2.0.5 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-49881
Patch Status
Patched
Published
Jun 12, 2025
Affected Software
Responsive Blocks – WordPress Gutenberg Blocks
Researcher
More Details >

Simply Schedule Appointments <= 1.6.8.30 – Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-4667
Patch Status
Patched
Published
Jun 13, 2025
Affected Software
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin
Researcher
More Details >

Slider, Gallery, and Carousel by MetaSlider <= 3.98.0 – Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via aria-label Parameter

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-5337
Patch Status
Patched
Published
Jun 13, 2025
Affected Software
Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider
Researcher
More Details >

Smash Balloon Custom Facebook Feed <= 4.3.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via `data-color` Attribute

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-4577
Patch Status
Patched
Published
Jun 9, 2025
Affected Software
Smash Balloon Social Post Feed – Simple Social Feeds for WordPress
Researcher
More Details >

StreamWeasels Kick Integration <= 1.1.3 – Authenticated (Contributor+) Stored Cross-Site Scripting via status-classic-offline-text Parameter

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-5589
Patch Status
Patched
Published
Jun 13, 2025
Affected Software
StreamWeasels Kick Integration
Researcher
More Details >

The Events Calendar <= 6.13.2 – Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-5144
Patch Status
Patched
Published
Jun 10, 2025
Affected Software
The Events Calendar
Researcher
More Details >

Ultimate Blocks – WordPress Blocks Plugin <= 3.3.3 – Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-2918
Patch Status
Patched
Published
Jun 9, 2025
Affected Software
Ultimate Blocks – WordPress Blocks Plugin
Researcher
More Details >

WP Views Counter <= 2.0.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-49859
Patch Status
Patched
Published
Jun 12, 2025
Affected Software
WP Views Counter
Researcher
More Details >

WPAdverts <= 2.2.4 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-49878
Patch Status
Patched
Published
Jun 12, 2025
Affected Software
WPAdverts – Classifieds Plugin
Researcher
More Details >

YITH WooCommerce Wishlist <= 4.5.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-5238
Patch Status
Patched
Published
Jun 13, 2025
Affected Software
YITH WooCommerce Wishlist
Researcher
More Details >

ZotPress <= 7.3.15 – Authenticated (Author+) Stored Cross-Site Scripting via ‘nickname’

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-4666
Patch Status
Unpatched
Published
Jun 10, 2025
Affected Software
Zotpress
Researcher
More Details >

Automation By Autonami <= 3.6.0 – Open Redirect

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-49868
Patch Status
Patched
Published
Jun 12, 2025
Affected Software
FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce
Researcher
More Details >

Easy Flashcards <= 0.1 – Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-6040
Patch Status
Unpatched
Published
Jun 13, 2025
Affected Software
Easy Flashcards
Researcher
More Details >

eForm – WordPress Form Builder < 4.19.1 – Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-48333
Patch Status
Patched
Published
Jun 11, 2025
Affected Software
eForm – WordPress Form Builder
Researcher
More Details >

Elite Video Player <= 10.0.5 – Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-30988
Patch Status
Unpatched
Published
Jun 11, 2025
Affected Software
Elite Video Player
Researcher
More Details >

Link Shield <= 0.5.4 – Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-5926
Patch Status
Unpatched
Published
Jun 12, 2025
Affected Software
Link Shield
Researcher
More Details >

Nasa Core <= 6.3.2 – Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-39508
Patch Status
Unpatched
Published
Jun 12, 2025
Affected Software
Nasa Core
Researcher
More Details >

Track, Analyze & Optimize by WP Tao <= 1.3 – Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-48145
Patch Status
Unpatched
Published
Jun 11, 2025
Affected Software
Track, Analyze & Optimize by WP Tao
Researcher
More Details >

Ultimate Reviews <= 3.2.14 – Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-49266
Patch Status
Patched
Published
Jun 11, 2025
Affected Software
Ultimate Reviews
Researcher
More Details >

WidgetKit Pro <= 1.13.1 – Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-46494
Patch Status
Unpatched
Published
Jun 12, 2025
Affected Software
WidgetKit Pro
Researcher
More Details >

WP URL Shortener <= 1.2 – Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-6064
Patch Status
Unpatched
Published
Jun 13, 2025
Affected Software
WP URL Shortener
Researcher
More Details >

XiSearch bar <= 2.6 – Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-6063
Patch Status
Unpatched
Published
Jun 13, 2025
Affected Software
XiSearch bar
Researcher
More Details >

Zen Sticky Social <= 0.3 – Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-6055
Patch Status
Unpatched
Published
Jun 13, 2025
Affected Software
Zen Sticky Social
Researcher
More Details >

UserPro – Community and User Profile WordPress Plugin <= 5.1.10 – Unauthenticated Arbitrary File Read

5.9
CVSS Rating
Medium (5.9)
CVE-ID
CVE-2025-4187
Patch Status
Unpatched
Published
Jun 13, 2025
Affected Software
UserPro – Community and User Profile WordPress Plugin
Researcher
More Details >

Auto Attachments <= 1.8.5 – Authenticated (Administrator+) Stored Cross-Site Scripting

5.5
CVSS Rating
Medium (5.5)
CVE-ID
CVE-2025-6012
Patch Status
Unpatched
Published
Jun 12, 2025
Affected Software
Auto Attachments
Researcher
More Details >

Aeroscroll Gallery – Infinite Scroll Image Gallery & Post Grid with Photo Gallery <= 1.0.12 – Unauthenticated Directory Traversal

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-49451
Patch Status
Unpatched
Published
Jun 9, 2025
Affected Software
Aeroscroll Gallery – Infinite Scroll Image Gallery & Post Grid with Photo Gallery
Researcher
More Details >

AFS Analytics <= 4.21 – Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-49864
Patch Status
Patched
Published
Jun 12, 2025
Affected Software
AFS Analytics
Researcher
More Details >

Digital Marketing and Agency Templates Addons for Elementor <= 1.1.1 – Cross-Site Request Forgery to Import

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-5938
Patch Status
Unpatched
Published
Jun 12, 2025
Affected Software
Digital Marketing and Agency Templates Addons for Elementor
Researcher
More Details >

Majestic Support <= 1.1.0 – Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-49860
Patch Status
Patched
Published
Jun 12, 2025
Affected Software
Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin
Researcher
More Details >

Membership For WooCommerce <= 2.8.1 – Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-49265
Patch Status
Patched
Published
Jun 9, 2025
Affected Software
Membership For WooCommerce
Researcher
More Details >

myCred <= 2.9.4.2 – Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-49872
Patch Status
Patched
Published
Jun 12, 2025
Affected Software
myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program.
Researcher
More Details >

Traffic Monitor <= 3.2.2 – Missing Authorization to Unauthenticated Settings Update

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-5815
Patch Status
Patched
Published
Jun 12, 2025
Affected Software
Traffic Monitor
Researcher
More Details >

WordPress Single Sign-On (SSO) – Multiple Versions – Incorrect Authorization to Sensitive Information Exposure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-6003
Patch Status
Patched
Published
Jun 11, 2025
Affected Software
WordPress Single Sign-On (SSO) – Single Site Standard
WordPress Single Sign-On (SSO) – Single Site Premium
WordPress Single Sign-On (SSO) – Multisite Premium
WordPress Single Sign-On (SSO) – Single Site Enterprise
WordPress Single Sign-On (SSO) – Multisite Enterprise
WordPress Single Sign-On (SSO) – Single Site All-Inclusive
WordPress Single Sign-On (SSO) – Multisite All-Inclusive
Researcher
More Details >

Slim SEO <= 4.5.4 – Authenticated (Administrator+) SQL Injection

4.9
CVSS Rating
Medium (4.9)
CVE-ID
CVE-2025-49854
Patch Status
Patched
Published
Jun 12, 2025
Affected Software
Slim SEO – Fast & Automated WordPress SEO Plugin
Researcher
More Details >

WP Employee Attendance System <= 3.5 – Authenticated (Administrator+) SQL Injection

4.9
CVSS Rating
Medium (4.9)
CVE-ID
CVE-2025-28972
Patch Status
Unpatched
Published
Jun 12, 2025
Affected Software
WP Employee Attendance System
Researcher
More Details >

WP-DownloadManager <= 1.68.10 – Authenticated (Administrator+) Arbitrary File Read

4.9
CVSS Rating
Medium (4.9)
CVE-ID
CVE-2025-4798
Patch Status
Patched
Published
Jun 10, 2025
Affected Software
WP-DownloadManager
Researcher
More Details >

Ebook Store <= 5.8008 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2025-49862
Patch Status
Patched
Published
Jun 12, 2025
Affected Software
Ebook Store
Researcher
More Details >

Noptin <= 3.8.7 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2025-49871
Patch Status
Patched
Published
Jun 12, 2025
Affected Software
Simple Newsletter Plugin – Noptin
Researcher
More Details >

Telegram for WP <= 1.6.1 – Authenticated (Admin+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2025-5939
Patch Status
Unpatched
Published
Jun 12, 2025
Affected Software
Telegram for WP
Researcher
More Details >

Advanced Settings <= 3.0.1 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-49865
Patch Status
Patched
Published
Jun 12, 2025
Affected Software
Advanced Settings 3
Researcher
More Details >

AI Image Lab – Free AI Image Generator <= 1.0.6 – Cross-Site Request Forgery to API Key Update

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-4592
Patch Status
Unpatched
Published
Jun 13, 2025
Affected Software
AI Image Lab – Free AI Image Generator
Researcher
More Details >

Arconix FAQ <= 1.9.6 – Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-49874
Patch Status
Patched
Published
Jun 12, 2025
Affected Software
Arconix FAQ
Researcher
More Details >

Bunny’s Print CSS <= 0.95 – Cross-Site Request Forgery to Settings Update

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-5925
Patch Status
Unpatched
Published
Jun 9, 2025
Affected Software
Bunny’s Print CSS
Researcher
More Details >

CubeWP Forms <= 1.1.5 – Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-49880
Patch Status
Patched
Published
Jun 12, 2025
Affected Software
CubeWP Forms – All-in-One Form Builder
Researcher
More Details >

myCred <= 2.9.4.2 – Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-49857
Patch Status
Patched
Published
Jun 12, 2025
Affected Software
myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program.
Researcher
More Details >

Responsive Plus <= 3.2.2 – Cross-Site Request Forgery to Settings Update

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-49856
Patch Status
Patched
Published
Jun 12, 2025
Affected Software
Responsive Plus – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme.
Researcher
More Details >

WP Sliding Login/Dashboard Panel <= 2.1.1 – Cross-Site Request Forgery to Settings Update

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-5928
Patch Status
Unpatched
Published
Jun 12, 2025
Affected Software
WP Sliding Login/Dashboard Panel
Researcher
More Details >

WP2HTML <= 1.0.2 – Cross-Site Request Forgery to Settings Update

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-5930
Patch Status
Unpatched
Published
Jun 12, 2025
Affected Software
WP2HTML
Researcher
More Details >

Yougler Blogger Profile Page <= v1.01 – Cross-Site Request Forgery to Settings Update

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-6062
Patch Status
Unpatched
Published
Jun 13, 2025
Affected Software
Yougler Blogger Profile Page
Researcher
More Details >

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

The post Wordfence Intelligence Weekly WordPress Vulnerability Report (June 9, 2025 to June 15, 2025) appeared first on Wordfence.

Leave a Comment