Wordfence Intelligence Weekly WordPress Vulnerability Report (July 28, 2025 to August 3, 2025)

by

📢 Calling all Vulnerability Researchers and Bug Bounty Hunters! 📢

🌞 Spring into Summer with Wordfence! Now through September 4, 2025, earn 2X bounty rewards for all in-scope submissions from our ‘High Threat’ list in software with fewer than 5 million active installs. Bounties up to $31,200 per vulnerability. Submit bold. Earn big!

💉 Participate in the SQLsplorer Challenge! Now through September 22, 2025, all SQL Injection vulnerabilities in software with at least 25 active installs are considered in-scope for all researchers, regardless of researcher tier AND earn a 20% bonus on all SQL Injection vulnerability submissions.

Last week, there were 107 vulnerabilities disclosed in 91 WordPress Plugins and 8 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 43 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back.

Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 28,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

Total Unpatched & Patched Vulnerabilities Last Week

Patch Status Number of Vulnerabilities
Patched 86
Unpatched 21

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating Number of Vulnerabilities
Medium Severity 74
High Severity 26
Critical Severity 7

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE Number of Vulnerabilities
Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) 42
Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’) 12
Missing Authorization 12
Cross-Site Request Forgery (CSRF) 9
Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) 5
Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) 4
Deserialization of Untrusted Data 3
Exposure of Sensitive Information to an Unauthorized Actor 3
Unrestricted Upload of File with Dangerous Type 3
Authorization Bypass Through User-Controlled Key 2
Improper Privilege Management 2
Incorrect Privilege Assignment 2
Absolute Path Traversal 1
Authentication Bypass Using an Alternate Path or Channel 1
Concurrent Execution using Shared Resource with Improper Synchronization (‘Race Condition’) 1
Improper Authorization 1
Improper Control of Generation of Code (‘Code Injection’) 1
Incorrect Authorization 1
Server-Side Request Forgery (SSRF) 1
URL Redirection to Untrusted Site (‘Open Redirect’) 1

Researchers That Contributed to WordPress Security Last Week

Researcher Name Number of Vulnerabilities
9
8
8
8
5
4
4
3
3
3
3
3
3
2
2
2
2
2
2
2
2
2
2
2
2
2
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1

Bao
1

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name Software Slug
360 Photo Spheres 360-sphere-images
Advanced Google Universal Analytics advanced-google-universal-analytics
AI Engine ai-engine
All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier aio-time-clock-lite
Appointment Booking Plugin for WordPress | Efficient Booking, Calendar & Client Scheduling – Bookify bookify
BeeTeam368 Extensions beeteam368-extensions
BerqWP – Automated All-In-One Page Speed Optimization for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript searchpro
BitFire Security – Firewall, WAF, Bot/Spam Blocker, Login Security bitfire
BlockSpare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites – Post Grids, Sliders, Carousels, Counters, Page Builder & Starter Site Imports, No Coding Needed blockspare
Bonanza – WooCommerce Free Gifts Lite bonanza-woocommerce-free-gifts-lite
Brave Conversion Engine (PRO) bravepopup-pro
Brizy – Page Builder brizy
BuddyPress XProfile Custom Image Field buddypress-xprofile-image-field
Button Block – Get fully customizable & multi-functional buttons button-block
Chartify – WordPress Chart Plugin chart-builder
Classified Listing – Classified ads & Business Directory Plugin classified-listing
Connector for Gravity Forms and Google Sheets wp-gravity-forms-spreadsheets
Content Egg content-egg
Custom API for WP custom-api-for-wp
Custom Word Cloud custom-word-cloud
Customer Reviews for WooCommerce customer-reviews-woocommerce
DELUCKS SEO delucks-seo
Easiest Funnel Builder For WordPress & WooCommerce, Specialized For Digital Creators – WPFunnels wpfunnels
Easy Elementor Addons easy-elementor-addons
Ebook Store ebook-store
Elementor Website Builder – More Than Just a Page Builder elementor
Event Booking Manager for WooCommerce – WpEvently mage-eventpress
Fan Page fan-page
File Manager for Google Drive – Integrate Google Drive with WordPress integrate-google-drive
GiveWP – Donation Plugin and Fundraising Platform give
Google Map Targeting gmap-targeting
Graphina – Elementor Charts and Graphs graphina-elementor-charts-and-graphs
Gutenberg Blocks – PublishPress Blocks Controls, Visibility, Reusable Blocks advanced-gutenberg
HT Mega – Absolute Addons For Elementor ht-mega-for-elementor
Hydra Booking – All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings hydra-booking
IDonate – Blood Donation, Request And Donor Management System idonate
Image Gallery bee-quick-gallery
Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms cf7-constant-contact
JetEngine jet-engine
JetTabs jet-tabs
Magic Edge – Lite magic-edge-lite-image-background-remover
Magical Addons For Elementor ( Header Footer Builder, Free Elementor Widgets, Elementor Templates Library ) magical-addons-for-elementor
Magical Posts Display – Elementor Advanced Posts widgets magical-posts-display
Masteriyo LMS – Online Course Builder for eLearning, LMS & Education learning-management-system
Medical Addon for Elementor medical-addon-for-elementor
MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor metform
Mmm Unity Loader mmm-unity-loader
Motors – Car Dealership & Classified Listings Plugin motors-car-dealership-classified-listings
myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program. mycred
Newsletters newsletters-lite
NinjaScanner – Virus & Malware scan ninjascanner
Ocean Social Sharing ocean-social-sharing
oik oik
Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction paid-member-subscriptions
Photo Engine (Media Organizer & Lightroom) wplr-sync
Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons, OpenAI contest-gallery
PressForward pressforward
Product Configurator for WooCommerce product-configurator-for-woocommerce
Product XML Feed Manager for WooCommerce – Google Shopping, Social Sites, Skroutz & More product-xml-feeds-for-woocommerce
Qi Addons For Elementor qi-addons-for-elementor
Realtyna Organic IDX plugin + WPL Real Estate real-estate-listing-realtyna-wpl
RT-Theme 18 Responsive WordPress Theme rt18-extensions
SEO Metrics seo-metrics-helper
Service Finder Bookings sf-booking
Service Finder SMS System aone-sms
ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization shortpixel-adaptive-images
Simple File List simple-file-list
Sina Extension for Elementor (Header Builder, Footer Builter, Theme Builder, Slider, Gallery, Form, Modal, Data Table Free Elementor Widgets & Elementor Templates) sina-extension-for-elementor
Sky Addons – Elementor Addons with Widgets & Templates sky-elementor-addons
Smart Slider 3 smart-slider-3
StoreKeeper for WooCommerce storekeeper-for-woocommerce
Stratum – Elementor Widgets stratum
StreamWeasels Kick Integration streamweasels-kick-integration
StreamWeasels Twitch Integration streamweasels-twitch-integration
StreamWeasels YouTube Integration streamweasels-youtube-integration
Super Store Finder superstorefinder-wp
Supermalink supermalink
SureDash suredash
The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce the-plus-addons-for-elementor-page-builder
Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder) header-footer-elementor
Woffice Core woffice-core
woozone-contextual woozone-contextual
WordPress Booking Plugin – TheBooking thebooking
WordPress Image Gallery Plugin – WordPress Photo Gallery cubeportfolio
WP CTA easy-sticky-sidebar
WP LOL Rotation league-of-legends-rotation
WP Modal Popup with Cookie Integration wp-modal-popup-with-cookie-integration
WP REST Cache wp-rest-cache
YITH WooCommerce Popup yith-woocommerce-popup
YouTube Embed – YouTube Gallery, Vimeo Gallery – WordPress Plugin youram-youtube-embed

WordPress Themes with Reported Vulnerabilities Last Week

Software Name Software Slug
Appzend appzend
Blogger Buzz blogger-buzz
Bricks bricks
Cook&Meal – Food Blog & Recipe WordPress Theme cookandmeal
Druco – Elementor WooCommerce WordPress Theme druco
Exertio – Freelance Marketplace WordPress Theme exertio
MediCenter – Health Medical Clinic WordPress Theme medicenter
News Magazine X news-magazine-x

Vulnerability Details

Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.

Brave Conversion Engine (PRO) <= 0.7.7 – Authentication Bypass to Administrator

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-7710
Patch Status
Patched
Published
Aug 1, 2025
Affected Software
Brave Conversion Engine (PRO)
Researcher
More Details >

Gutenberg Blocks <= 3.3.1 – Unauthenticated Local File Inclusion

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-48332
Patch Status
Patched
Published
Jul 28, 2025
Affected Software
Gutenberg Blocks – PublishPress Blocks Controls, Visibility, Reusable Blocks
Researcher
More Details >

RT-Theme 18 | Extensions <= 2.4 – Unauthenticated Local File Inclusion

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-32288
Patch Status
Unpatched
Published
Jul 28, 2025
Affected Software
RT-Theme 18 Responsive WordPress Theme
Researcher
More Details >

Service Finder Bookings <= 6.0 – Authentication Bypass via User Switch Cookie

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-5947
Patch Status
Patched
Published
Jul 31, 2025
Affected Software
Service Finder Bookings
Researcher
More Details >

Service Finder SMS System <= 2.0.0 – Unauthenticated Privilege Escalation

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-5954
Patch Status
Patched
Published
Jul 31, 2025
Affected Software
Service Finder SMS System
Researcher
More Details >

StoreKeeper for WooCommerce <= 14.4.4 – Unauthenticated Arbitrary File Upload

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-48148
Patch Status
Patched
Published
Jul 31, 2025
Affected Software
StoreKeeper for WooCommerce
Researcher
More Details >

BuddyPress XProfile Custom Image Field <= 3.0.1 – Unauthenticated Arbitrary File Deletion

9.1
CVSS Rating
Critical (9.1)
CVE-ID
CVE-2025-48158
Patch Status
Patched
Published
Jul 31, 2025
Affected Software
BuddyPress XProfile Custom Image Field
Researcher
More Details >

AI Engine 2.9.3 – 2.9.4 – Authenticated (Subscriber+) Arbitrary File Upload

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-7847
Patch Status
Patched
Published
Jul 30, 2025
Affected Software
AI Engine
Researcher
More Details >

Bookify <= 1.0.9 – Authenticated (Subscriber+) Privilege Escalation

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-48142
Patch Status
Patched
Published
Jul 29, 2025
Affected Software
Appointment Booking Plugin for WordPress | Efficient Booking, Calendar & Client Scheduling – Bookify
Researcher
More Details >

Custom API for WP <= 4.2.2 – Authenticated (Subscriber+) Privilege Escalation

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-54049
Patch Status
Patched
Published
Jul 28, 2025
Affected Software
Custom API for WP
Researcher
More Details >

DELUCKS SEO <= 2.6.0 – Authenticated (Subscriber+) Privilege Escalation

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-48165
Patch Status
Patched
Published
Jul 31, 2025
Affected Software
DELUCKS SEO
Researcher
More Details >

Hydra Booking 1.1.0 – 1.1.18 – Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via tfhb_reset_password_callback Function

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-7689
Patch Status
Patched
Published
Jul 28, 2025
Affected Software
Hydra Booking – All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings
Researcher
More Details >

Product XML Feed Manager for WooCommerce <= 2.9.3 – Authenticated (Contributor+) Remote Code Execution

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-49887
Patch Status
Patched
Published
Jul 31, 2025
Affected Software
Product XML Feed Manager for WooCommerce – Google Shopping, Social Sites, Skroutz & More
Researcher
More Details >

SEO Metrics <= 1.0.5 – Missing Authorization to Authenticated (Subscriber+) Privilege Escalation

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-6754
Patch Status
Unpatched
Published
Aug 1, 2025
Affected Software
SEO Metrics
Researcher
More Details >

SureDash <= 1.0.3 – Authenticated (Subscriber+) Privilege Escalation

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-48164
Patch Status
Patched
Published
Jul 28, 2025
Affected Software
SureDash
Researcher
More Details >

BeeTeam368 Extensions <= 1.9.4 – Unauthenticated Local File Inclusion

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2025-25174
Patch Status
Unpatched
Published
Jul 30, 2025
Affected Software
BeeTeam368 Extensions
Researcher
More Details >

BerqWP <= 2.2.42 – Unauthenticated Arbitrary File Upload

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2025-7443
Patch Status
Patched
Published
Jul 31, 2025
Affected Software
BerqWP – Automated All-In-One Page Speed Optimization for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript
Researcher
More Details >

Cook&Meal <= 1.2.3 – Unauthenticated Local File Inclusion

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2025-48149
Patch Status
Patched
Published
Jul 30, 2025
Affected Software
Cook&Meal – Food Blog & Recipe WordPress Theme
Researcher
More Details >

Exertio <= 1.3.2 – Unauthenticated PHP Object Injection

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2025-54686
Patch Status
Patched
Published
Jul 31, 2025
Affected Software
Exertio – Freelance Marketplace WordPress Theme
Researcher
More Details >

Graphina <= 3.1.1 – Unauthenticated Local File Inclusion

8.1
CVSS Rating
High (8.1)
CVE-ID
Unknown
Patch Status
Unpatched
Published
Jul 28, 2025
Affected Software
Graphina – Elementor Charts and Graphs
Researcher
More Details >

MediCenter – Health Medical Clinic <= 15.1 – Unauthenticated PHP Object Injection

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2025-54014
Patch Status
Patched
Published
Jul 28, 2025
Affected Software
MediCenter – Health Medical Clinic WordPress Theme
Researcher
More Details >

News Magazine X <= 1.2.35 – Unauthenticated Local File Inclusion

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2025-24766
Patch Status
Unpatched
Published
Jul 28, 2025
Affected Software
News Magazine X
Researcher
More Details >

Newsletters <= 4.10 – Unauthenticated Local File Inclusion

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2025-54034
Patch Status
Patched
Published
Jul 29, 2025
Affected Software
Newsletters
Researcher
More Details >

Paid Membership Subscriptions <= 2.15.5 – Unauthenticated Local File Inclusion

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2025-54017
Patch Status
Patched
Published
Jul 29, 2025
Affected Software
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
Researcher
More Details >

Paid Membership Subscriptions <= 2.15.5 – Unauthenticated Local File Inclusion

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2025-54017
Patch Status
Patched
Published
Jul 29, 2025
Affected Software
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
Researcher
More Details >

Realtyna Organic IDX plugin <= 5.0.0 – Unauthenticated Local File Inclusion

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2025-54052
Patch Status
Patched
Published
Jul 30, 2025
Affected Software
Realtyna Organic IDX plugin + WPL Real Estate
Researcher
More Details >

WP REST Cache <= 2025.1.0 – Unauthenticated Local File Inclusion

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2025-52716
Patch Status
Patched
Published
Jul 28, 2025
Affected Software
WP REST Cache
Researcher
More Details >

Amazon Native Shopping Recommendations <= 1.3 – Unauthenticated SQL Injection

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2025-30633
Patch Status
Unpatched
Published
Jul 31, 2025
Affected Software
woozone-contextual
Researcher
More Details >

Bricks Builder <= 1.12.4 – Unauthenticated SQL Injection via `p` Parameter

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2025-6495
Patch Status
Patched
Published
Jul 28, 2025
Affected Software
Bricks
Researcher
More Details >

Google Map Targeting <= 1.1.6 – Authenticated (Subscriber+) Local File Inclusion

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2025-52732
Patch Status
Patched
Published
Jul 31, 2025
Affected Software
Google Map Targeting
Researcher
More Details >

Super Store Finder <= 7.5 – Unauthenticated SQL Injection

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2025-52720
Patch Status
Patched
Published
Jul 31, 2025
Affected Software
Super Store Finder
Researcher
More Details >

NinjaScanner – Virus & Malware scan <= 3.2.5 – Authenticated (Administrator+) Arbitrary File Deletion

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2025-8213
Patch Status
Patched
Published
Jul 30, 2025
Affected Software
NinjaScanner – Virus & Malware scan
Researcher
More Details >

Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons, OpenAI <= 26.1.0 – Unauthenticated Stored Cross-Site Scripting

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2025-7725
Patch Status
Patched
Published
Jul 31, 2025
Affected Software
Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons, OpenAI
Researcher
More Details >

Woffice Core <= 5.4.26 – Authenticated (Contributor+) Arbitrary File Deletion

6.8
CVSS Rating
Medium (6.8)
CVE-ID
CVE-2025-7694
Patch Status
Patched
Published
Aug 1, 2025
Affected Software
Woffice Core
Researcher
More Details >

Content Egg <= 7.0.0 – Authenticated (Editor+) PHP Object Injection

6.6
CVSS Rating
Medium (6.6)
CVE-ID
CVE-2025-47536
Patch Status
Patched
Published
Jul 30, 2025
Affected Software
Content Egg
Researcher
More Details >

Cube Portfolio <= 1.16.8 – Authenticated (Subscriber+) SQL Injection

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2025-52823
Patch Status
Unpatched
Published
Jul 31, 2025
Affected Software
WordPress Image Gallery Plugin – WordPress Photo Gallery
Researcher
More Details >

IDonate 2.0.0 – 2.1.9 – Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via admin_donor_profile_view Function

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2025-4523
Patch Status
Patched
Published
Jul 31, 2025
Affected Software
IDonate – Blood Donation, Request And Donor Management System
Researcher
More Details >

360 Photo Spheres <= 1.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-4588
Patch Status
Unpatched
Published
Aug 1, 2025
Affected Software
360 Photo Spheres
Researcher
More Details >

Appzend <= 1.2.6 – Authenticated (Contributor+) Stored Cross-Site Scripting via progressbarLayout Parameter

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-5587
Patch Status
Patched
Published
Jul 28, 2025
Affected Software
Appzend
Researcher
More Details >

BlockSpare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites <= 3.2.13.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via Image Carousel and Image Slider Widgets

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-4684
Patch Status
Patched
Published
Jul 31, 2025
Affected Software
BlockSpare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites – Post Grids, Sliders, Carousels, Counters, Page Builder & Starter Site Imports, No Coding Needed
Researcher
More Details >

Blogger Buzz <= 1.2.6 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-54680
Patch Status
Patched
Published
Jul 30, 2025
Affected Software
Blogger Buzz
Researcher
More Details >

Custom Word Cloud <= 0.3 – Authenticated (Contributor+) Stored Cross-Site Scripting via angle Parameter

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-8317
Patch Status
Unpatched
Published
Aug 1, 2025
Affected Software
Custom Word Cloud
Researcher
More Details >

Customer Reviews for WooCommerce <= 5.80.2 – Unauthenticated Stored Cross-Site Scripting via `author` Parameter

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-5720
Patch Status
Patched
Published
Jul 30, 2025
Affected Software
Customer Reviews for WooCommerce
Researcher
More Details >

Easy Elementor Addons <= 2.2.6 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-54704
Patch Status
Patched
Published
Jul 30, 2025
Affected Software
Easy Elementor Addons
Researcher
More Details >

Elementor <= 3.29.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-3075
Patch Status
Patched
Published
Jul 28, 2025
Affected Software
Elementor Website Builder – More Than Just a Page Builder
Researcher
More Details >

Elementor <= 3.30.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via Text Path Widget

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-4566
Patch Status
Patched
Published
Jul 28, 2025
Affected Software
Elementor Website Builder – More Than Just a Page Builder
Researcher
More Details >

Fan Page <= 1.0.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-6681
Patch Status
Unpatched
Published
Jul 28, 2025
Affected Software
Fan Page
Researcher
More Details >

JetEngine <= 3.7.1.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-54688
Patch Status
Patched
Published
Jul 30, 2025
Affected Software
JetEngine
Researcher
More Details >

JetTabs <= 2.2.9.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-54687
Patch Status
Patched
Published
Jul 30, 2025
Affected Software
JetTabs
Researcher
More Details >

Magic Edge – Lite <= 1.1.6 – Authenticated (Contributor+) Stored Cross-Site Scripting via height Parameter

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-8391
Patch Status
Unpatched
Published
Aug 1, 2025
Affected Software
Magic Edge – Lite
Researcher
More Details >

Magical Addons For Elementor <= 1.3.8 – Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Attributes

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-8196
Patch Status
Patched
Published
Jul 28, 2025
Affected Software
Magical Addons For Elementor ( Header Footer Builder, Free Elementor Widgets, Elementor Templates Library )
Researcher
More Details >

Magical Posts Display <= 1.2.52 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-54706
Patch Status
Patched
Published
Jul 30, 2025
Affected Software
Magical Posts Display – Elementor Advanced Posts widgets
Researcher
More Details >

Masteriyo – LMS <= 1.18.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-54699
Patch Status
Patched
Published
Jul 30, 2025
Affected Software
Masteriyo LMS – Online Course Builder for eLearning, LMS & Education
Researcher
More Details >

Medical Addon for Elementor <= 1.6.3 – Authenticated (Contributor+) Stored Cross-Site Scripting via Typewriter Widget

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-8212
Patch Status
Unpatched
Published
Aug 1, 2025
Affected Software
Medical Addon for Elementor
Researcher
More Details >

MetForm <= 4.0.1 – Authenticated(Contributor+) Stored Cross-Site Scripting via `mf-template` DOM Element

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-5684
Patch Status
Patched
Published
Jul 29, 2025
Affected Software
MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor
Researcher
More Details >

Mmm Unity Loader <= 1.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via attributes Parameter

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-8399
Patch Status
Unpatched
Published
Aug 1, 2025
Affected Software
Mmm Unity Loader
Researcher
More Details >

myCred <= 2.9.4.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-54668
Patch Status
Patched
Published
Jul 30, 2025
Affected Software
myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program.
Researcher
More Details >

Ocean Social Sharing <= 2.2.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-7500
Patch Status
Patched
Published
Aug 1, 2025
Affected Software
Ocean Social Sharing
Researcher
More Details >

Online Booking & Scheduling Calendar for WordPress by vcita <= 4.5.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-54676
Patch Status
Patched
Published
Jul 30, 2025
Affected Software
Online Booking & Scheduling Calendar for WordPress by vcita
Researcher
More Details >

PressForward <= 5.9.1 – Authenticated (Subscriber+) Server-Side Request Forgery

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-28987
Patch Status
Unpatched
Published
Jul 31, 2025
Affected Software
PressForward
Researcher
More Details >

Qi Addons for Elementor <= 1.9.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via TypeOut Text Widget

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-8146
Patch Status
Patched
Published
Aug 1, 2025
Affected Software
Qi Addons For Elementor
Researcher
More Details >

Sina Extension for Elementor <= 3.7.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via `Sina Posts`, `Sina Blog Post` and `Sina Table` Widgets

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-6228
Patch Status
Patched
Published
Jul 31, 2025
Affected Software
Sina Extension for Elementor (Header Builder, Footer Builter, Theme Builder, Slider, Gallery, Form, Modal, Data Table Free Elementor Widgets & Elementor Templates)
Researcher
More Details >

Sky Addons for Elementor <= 3.1.4 – Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-8216
Patch Status
Patched
Published
Jul 28, 2025
Affected Software
Sky Addons – Elementor Addons with Widgets & Templates
Researcher
More Details >

Stratum – Elementor Widgets <= 1.6.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Google Maps and Image Hotspot Widgets

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-7845
Patch Status
Patched
Published
Jul 31, 2025
Affected Software
Stratum – Elementor Widgets
Researcher
More Details >

StreamWeasels Twitch Integration <= 1.9.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-7809
Patch Status
Patched
Published
Jul 28, 2025
Affected Software
StreamWeasels Twitch Integration
Researcher
More Details >

StreamWeasels YouTube Integration <= 1.4.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-7811
Patch Status
Patched
Published
Jul 28, 2025
Affected Software
StreamWeasels YouTube Integration
Researcher
More Details >

Supermalink <= 1.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-49433
Patch Status
Unpatched
Published
Jul 28, 2025
Affected Software
Supermalink
Researcher
More Details >

The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.3.10 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-7646
Patch Status
Patched
Published
Jul 31, 2025
Affected Software
The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce
Researcher
More Details >

WP LOL Rotation <= 1.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-49437
Patch Status
Unpatched
Published
Jul 29, 2025
Affected Software
WP LOL Rotation
Researcher
More Details >

WPFunnels <= 3.5.26 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-54696
Patch Status
Patched
Published
Jul 30, 2025
Affected Software
Easiest Funnel Builder For WordPress & WooCommerce, Specialized For Digital Creators – WPFunnels
Researcher
More Details >

YouTube Embed <= 10.3 – Authenticated (Contributor+) Stored Cross-Site Scripting via instance Parameter

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-6692
Patch Status
Unpatched
Published
Jul 28, 2025
Affected Software
YouTube Embed – YouTube Gallery, Vimeo Gallery – WordPress Plugin
Researcher
More Details >

All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier <= 2.0 – Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-6832
Patch Status
Patched
Published
Aug 1, 2025
Affected Software
All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier
Researcher
More Details >

Connector for Gravity Forms and Google Sheets <= 1.2.4 – Open Redirect

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-54681
Patch Status
Patched
Published
Jul 30, 2025
Affected Software
Connector for Gravity Forms and Google Sheets
Researcher
More Details >

Druco <= 1.5.2 – Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-54055
Patch Status
Patched
Published
Aug 2, 2025
Affected Software
Druco – Elementor WooCommerce WordPress Theme
Researcher
More Details >

Image Gallery <= 1.0.0 – Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-8400
Patch Status
Unpatched
Published
Aug 1, 2025
Affected Software
Image Gallery
Researcher
More Details >

WP Modal Popup with Cookie Integration <= 2.4 – Authenticated (Administrator+) Stored Cross-Site Scripting

5.5
CVSS Rating
Medium (5.5)
CVE-ID
CVE-2025-54683
Patch Status
Patched
Published
Jul 30, 2025
Affected Software
WP Modal Popup with Cookie Integration
Researcher
More Details >

GiveWP – Donation Plugin and Fundraising Platform <= 4.5.0 – Authenticated (GiveWP worker+) Stored Cross-Site Scripting

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2025-7205
Patch Status
Patched
Published
Jul 30, 2025
Affected Software
GiveWP – Donation Plugin and Fundraising Platform
Researcher
More Details >

StreamWeasels Kick Integration <= 1.1.4 – Authenticated (Contributor+) Stored Cross-Site Scripting

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2025-7810
Patch Status
Patched
Published
Jul 28, 2025
Affected Software
StreamWeasels Kick Integration
Researcher
More Details >

BitFire <= 4.5 – Unauthenticated Information Exposure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-6722
Patch Status
Patched
Published
Aug 1, 2025
Affected Software
BitFire Security – Firewall, WAF, Bot/Spam Blocker, Login Security
Researcher
More Details >

Brizy <= 2.6.20 – Missing Authorization to Unauthenticated Limited File Upload

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-4370
Patch Status
Patched
Published
Jul 28, 2025
Affected Software
Brizy – Page Builder
Researcher
More Details >

Motors <= 1.4.80 – Unauthenticated Insecure Direct Object Reference

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-54691
Patch Status
Patched
Published
Jul 30, 2025
Affected Software
Motors – Car Dealership & Classified Listings Plugin
Researcher
Bao
More Details >

Simple File List <= 6.1.14 – Unauthenticated Arbitrary File Download

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-54021
Patch Status
Patched
Published
Jul 28, 2025
Affected Software
Simple File List
Researcher
More Details >

TheBooking <= 1.4.4 – Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-52801
Patch Status
Unpatched
Published
Jul 30, 2025
Affected Software
WordPress Booking Plugin – TheBooking
Researcher
More Details >

WP CTA – Call To Action Plugin, Sticky CTA, Sticky Buttons <= 1.7.0 – Missing Authorization to Unauthenticated Sticky Status Update

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-8152
Patch Status
Patched
Published
Aug 1, 2025
Affected Software
WP CTA
Researcher
More Details >

Smart Slider 3 <= 3.5.1.28 – Authenticated (Administrator+) SQL Injection via `sliderid` Parameter

4.9
CVSS Rating
Medium (4.9)
CVE-ID
CVE-2025-6348
Patch Status
Patched
Published
Jul 29, 2025
Affected Software
Smart Slider 3
Researcher
More Details >

Integration for Contact Form 7 and Constant Contact <= 1.1.7 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2025-54684
Patch Status
Patched
Published
Jul 30, 2025
Affected Software
Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms
Researcher
More Details >

ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization <= 3.10.4 – Authenticated (Administrator+) Stored Cross-Site Scripting via API URL

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2025-6626
Patch Status
Patched
Published
Aug 1, 2025
Affected Software
ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization
Researcher
More Details >

Advanced Google Universal Analytics <= 1.0.3 – Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-28962
Patch Status
Unpatched
Published
Jul 28, 2025
Affected Software
Advanced Google Universal Analytics
Researcher
More Details >

Bonanza – WooCommerce Free Gifts Lite <= 1.0.0 – Missing Authorization to Authenticated (Subscriber+) Opt In Success

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-6730
Patch Status
Unpatched
Published
Jul 28, 2025
Affected Software
Bonanza – WooCommerce Free Gifts Lite
Researcher
More Details >

Button Block <= 1.2.0 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-54694
Patch Status
Patched
Published
Jul 30, 2025
Affected Software
Button Block – Get fully customizable & multi-functional buttons
Researcher
More Details >

Chartify <= 3.5.3 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-54673
Patch Status
Patched
Published
Jul 30, 2025
Affected Software
Chartify – WordPress Chart Plugin
Researcher
More Details >

Classified Listing <= 5.0.0 – Authenticated (Contributor+) Content Injection

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-54698
Patch Status
Patched
Published
Jul 30, 2025
Affected Software
Classified Listing – Classified ads & Business Directory Plugin
Researcher
More Details >

Connector for Gravity Forms and Google Sheets <= 1.2.4 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-54682
Patch Status
Patched
Published
Jul 30, 2025
Affected Software
Connector for Gravity Forms and Google Sheets
Researcher
More Details >

Ebook Store <= 5.8013 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-54702
Patch Status
Patched
Published
Jul 30, 2025
Affected Software
Ebook Store
Researcher
More Details >

HT Mega – Absolute Addons For Elementor <= 2.9.1 – Authenticated (Author+) Path Traversal to Limited Arbitrary CSS File Actions

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-8151
Patch Status
Patched
Published
Jul 30, 2025
Affected Software
HT Mega – Absolute Addons For Elementor
Researcher
More Details >

HT Mega – Absolute Addons For Elementor <= 2.9.1 – Authenticated (Author+) Sensitive Information Exposure

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-8401
Patch Status
Patched
Published
Jul 30, 2025
Affected Software
HT Mega – Absolute Addons For Elementor
Researcher
More Details >

HT Mega – Absolute Addons For Elementor <= 2.9.1 – Improper Authorization to Authenticated (Contributor+) Limited Administrator Actions

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-8068
Patch Status
Patched
Published
Jul 30, 2025
Affected Software
HT Mega – Absolute Addons For Elementor
Researcher
More Details >

HT Mega <= 2.9.0 – Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-54695
Patch Status
Patched
Published
Jul 30, 2025
Affected Software
HT Mega – Absolute Addons For Elementor
Researcher
More Details >

Integrate Google Drive <= 1.5.2 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-54703
Patch Status
Patched
Published
Jul 30, 2025
Affected Software
File Manager for Google Drive – Integrate Google Drive with WordPress
Researcher
More Details >

myCred <= 2.9.4.3 – Authenticated (Subscriber+) Race Condition

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-54667
Patch Status
Patched
Published
Jul 30, 2025
Affected Software
myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program.
Researcher
More Details >

oik <= 4.15.2 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-54671
Patch Status
Patched
Published
Jul 30, 2025
Affected Software
oik
Researcher
More Details >

Photo Engine <= 6.4.3 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-54672
Patch Status
Patched
Published
Jul 30, 2025
Affected Software
Photo Engine (Media Organizer & Lightroom)
Researcher
More Details >

Product Configurator for WooCommerce <= 1.4.4 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-54674
Patch Status
Patched
Published
Jul 30, 2025
Affected Software
Product Configurator for WooCommerce
Researcher
More Details >

SureDash <= 1.1.0 – Authenticated (Subscriber+) Information Disclosure

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-54685
Patch Status
Patched
Published
Jul 31, 2025
Affected Software
SureDash
Researcher
More Details >

Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder) <= 2.4.6 – Missing Authorization to Authenticated (Subscriber+) Limited Settings Update

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-8488
Patch Status
Patched
Published
Aug 1, 2025
Affected Software
Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder)
Researcher
More Details >

WpEvently <= 4.4.6 – Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-54705
Patch Status
Patched
Published
Jul 30, 2025
Affected Software
Event Booking Manager for WooCommerce – WpEvently
Researcher
More Details >

YITH WooCommerce Popup <= 1.48.0 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-54675
Patch Status
Patched
Published
Jul 30, 2025
Affected Software
YITH WooCommerce Popup
Researcher
More Details >

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

The post Wordfence Intelligence Weekly WordPress Vulnerability Report (July 28, 2025 to August 3, 2025) appeared first on Wordfence.

Leave a Comment