Wordfence Intelligence Weekly WordPress Vulnerability Report (October 13, 2025 to October 19, 2025)

by

📢 Calling all Vulnerability Researchers and Bug Bounty Hunters! 📢

🚀  Operation: Maximum Impact Challenge! Now through November 10, 2025, earn 2X bounty rewards for all in-scope submissions in software with at least 5,000 active installs and fewer than 5 million active installs. Bounties up to $31,200 per vulnerability. Submit bold. Earn big!

📁 The LFInder Challenge: Refine your LFI hunting skills with an expanded scope. Now through November 24, 2025, all LFI vulnerabilities in software with at least 25 active installs are considered in-scope for all researchers, regardless of researcher tier, AND earn a 30% bonus on all Local File Inclusion vulnerability submissions not already increased by another promotion.

Last week, there were 118 vulnerabilities disclosed in 99 WordPress Plugins and 7 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 40 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back.

Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 29,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

New Firewall Rules Deployed Last Week

The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.

The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:

  • WAF-RULE-866 – Data redacted while we work with the vendor on a patch.
  • WAF-RULE-867 – Data redacted while we work with the vendor on a patch.
  • WAF-RULE-868 – Data redacted while we work with the vendor on a patch.

Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.

Total Unpatched & Patched Vulnerabilities Last Week

Patch Status Number of Vulnerabilities
Patched 76
Unpatched 42

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating Number of Vulnerabilities
Medium Severity 91
High Severity 21
Critical Severity 6

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE Number of Vulnerabilities
Missing Authorization 27
Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) 24
Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) 15
Cross-Site Request Forgery (CSRF) 13
Authorization Bypass Through User-Controlled Key 6
Exposure of Sensitive Information to an Unauthorized Actor 6
Unrestricted Upload of File with Dangerous Type 4
Authentication Bypass Using an Alternate Path or Channel 2
Improper Authorization 2
Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’) 2
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) 2
Incorrect Privilege Assignment 2
Server-Side Request Forgery (SSRF) 2
Acceptance of Extraneous Untrusted Data With Trusted Data 1
Deserialization of Untrusted Data 1
External Control of File Name or Path 1
Improper Authentication 1
Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) 1
Improper Neutralization of Alternate XSS Syntax 1
Improper Privilege Management 1
Insertion of Sensitive Information into Log File 1
Insertion of Sensitive Information Into Sent Data 1
Missing Authentication for Critical Function 1
Use of Hard-coded Credentials 1

Researchers That Contributed to WordPress Security Last Week

Researcher Name Number of Vulnerabilities
18
16
7
6
6
5
5
4
4
4
4
3
3
2
2
2
2
2
2
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name Software Slug
Acknowledgify acknowledgify
Advanced Coupons – WooCommerce Coupons & Store Credit advanced-coupons-for-woocommerce-free
Ally – Web Accessibility & Usability pojo-accessibility
Binary MLM Plan binary-mlm-plan
Block Country block-country
BlockSpare — News, Magazine and Blog Addons for (Gutenberg) Block Editor blockspare
Content Writer content-writer
Demo Import Kit demo-import-kit
Dhivehi Text dhivehi-text
Digiseller digiseller
DocoDoco Store Locator docodoco-store-locator
Dynamically Display Posts dynamically-display-posts
E2Pdf – Export Pdf Tool for WordPress e2pdf
Easy Post Submission – Frontend Posting, Guest Publishing & Submit Content for WordPress easy-post-submission
Event post event-post
Event Tickets and Registration event-tickets
Events Calendar Made Simple – Pie Calendar pie-calendar
External Login external-login
FileBird – WordPress Media Library Folders & File Manager filebird
Find And Replace content for WordPress find-and-replace-content
Flex QR Code Generator flex-qr-code-generator
Free Follow-Up Emails & Marketing Automation for WooCommerce – ShopMagic shopmagic-for-woocommerce
Front End Users front-end-only-users
FunKItools funkitools
GSpeech TTS – WordPress Text To Speech Plugin gspeech
Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns essential-blocks
Houzez Theme – Functionality houzez-theme-functionality
Keyy Two Factor Authentication (like Clef) keyy
Kognetiks Chatbot chatbot-chatgpt
LearnPress – WordPress LMS Plugin learnpress
Library Management System library-management-system
Lisfinity Core – Lisfinity Core plugin used for pebas® Lisfinity WordPress theme lisfinity-core
MasterStudy LMS WordPress Plugin – for Online Courses and Education masterstudy-lms-learning-management-system
MDTF – Meta Data and Taxonomies Filter wp-meta-data-filter-and-taxonomy-filter
Media Library Assistant media-library-assistant
MeetingHub for Zoom Meeting, Google Meet, Jitsi Meet, Webex, & Microsoft Teams | The All-in-One Webinar & Video Conference Solution meetinghub
Oceanpayment CreditCard Gateway oceanpayment-creditcard-gateway
One Page Express Companion one-page-express-companion
onOffice for WP-Websites onoffice-for-wp-websites
Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization optimole-wp
Orion SMS OTP Verification orion-sms-otp-verification
Outdoor outdoor
Ova Advent ova-advent
OwnID Passwordless Login ownid-passwordless-login
PowerBI Embed Reports embed-power-bi-reports
PPOM – Product Addons & Custom Fields for WooCommerce woocommerce-product-addon
Product Bundles, Quantity/Bulk Discount, BOGO, Buy X Get Y – WowRevenue revenue
Product Catalog Simple post-type-x
Product Table For WooCommerce product-table-for-woocommerce
Quick Featured Images quick-featured-images
Quick Social Login quick-login
Redirection for Contact Form 7 wpcf7-redirect
Related Posts Lite related-posts-lite
replyMail replymail
Reviews Widgets for Google & 45+ platforms by Repuso social-testimonials-and-reviews-widget
Rich Snippet Site Report easysnippet
Shortcode Button shortcode-button
ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF shortpixel-image-optimiser
Simple Job Board simple-job-board
Simple Stripe simple-stripe
Slick Google Map slick-google-map
SmartCrawl SEO checker, analyzer & optimizer smartcrawl-seo
SUMO Memberships for WooCommerce sumomemberships
SureForms – Drag and Drop Contact Form Builder – Multi-step Forms, Conversational Forms and more sureforms
Tab Ultimate tabs-pro
tagDiv Cloud Library td-cloud-library
tagDiv Composer td-composer
TARIFFUXX tariffuxx
Task Scheduler task-scheduler
thegem-elements thegem-elements
Theme Editor theme-editor
Theme Importer theme-importer
TopBar topbar
Truelysell Core truelysell-core
u-design-core u-design-core
UiChemy — Figma Converter for Elementor, Gutenberg and Bricks uichemy
UPC/EAN/GTIN Barcode Generator/Importer upc-ean-barcode-generator
URLYar URL Shortner urlyar
Voice Feedback – Voice Recorder for Audio Feedback voice-feedback
WhyDonate – FREE Donate button – Crowdfunding – Fundraising wp-whydonate
Woocommerce Category and Products Accordion Panel accordion-panel-for-category-and-products
WP BookWidgets wp-bookwidgets
WP Dashboard Chat wp-dashboard-chat
WP Go Maps (formerly WP Google Maps) wp-google-maps
WP Google Map Plugin wp-google-map
WP jQuery Pager wp-jquery-pdf-paged
WP SMS – Ultimate SMS & MMS Notifications, OTP, 2FA, and WooCommerce & Forms Integrations wp-sms
Wp tabber widget wp-tabber-widget
WP Travel Gutenberg Blocks wp-travel-blocks
WP ViewSTL wp-viewstl
WPBakery Page Builder js_composer
WPBifröst – Instant Passwordless Temporary Login Links create-temporary-login
WPC Smart Quick View for WooCommerce woo-smart-quick-view
WPC Smart Wishlist for WooCommerce woo-smart-wishlist
WPCasa wpcasa
wpNamedUsers wpnamedusers
XX2WP Integration Tools fb2wp-integration-tools
YourMembership Single Sign On – YM SSO Login login-with-yourmembership
Zip Attachments zip-attachments

WordPress Themes with Reported Vulnerabilities Last Week

Software Name Software Slug
ClassifiedPro – reCommerce WordPress Theme classified-pro
Felan Framework felan-framework
HiStudy – Online Courses & Education Template histudy
HomeLancer homelancer
KALLYAS – Creative eCommerce Multi-Purpose WordPress Theme kallyas
Salient | Creative Multipurpose & WooCommerce Theme salient
XStore xstore

Vulnerability Details

Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.

Felan Framework <= 1.1.4 – Hardcoded Credentials

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-10850
Patch Status
Patched
Published
Oct 15, 2025
Affected Software
Felan Framework
Researcher
More Details >

Flex QR Code Generator <= 1.2.5 – Unauthenticated Arbitrary File Upload

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-10041
Patch Status
Patched
Published
Oct 14, 2025
Affected Software
Flex QR Code Generator
Researcher
More Details >

Orion SMS OTP Verification <= 1.1.7 – Authentication Bypass via Account Takeover

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-9967
Patch Status
Unpatched
Published
Oct 14, 2025
Affected Software
Orion SMS OTP Verification
Researcher
More Details >

OwnID Passwordless Login <= 1.3.4 – Authentication Bypass

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-10294
Patch Status
Unpatched
Published
Oct 14, 2025
Affected Software
OwnID Passwordless Login
Researcher
More Details >

PPOM – Product Addons & Custom Fields for WooCommerce <= 33.0.15 – Unauthenticated Arbitrary File Upload

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-11391
Patch Status
Patched
Published
Oct 17, 2025
Affected Software
PPOM – Product Addons & Custom Fields for WooCommerce
Researcher
More Details >

Truelysell Core <= 1.8.6 – Unauthenticated Arbitrary User Password Change

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-10742
Patch Status
Unpatched
Published
Oct 15, 2025
Affected Software
Truelysell Core
Researcher
More Details >

Classified Pro <= 1.0.14 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-10706
Patch Status
Unpatched
Published
Oct 15, 2025
Affected Software
ClassifiedPro – reCommerce WordPress Theme
Researcher
More Details >

Keyy Two Factor Authentication (like Clef) <= 1.2.3 – Authenticated (Subscriber+) Privilege Escalation via Account Takeover

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-10293
Patch Status
Unpatched
Published
Oct 14, 2025
Affected Software
Keyy Two Factor Authentication (like Clef)
Researcher
More Details >

Theme Editor <= 3.0 – Cross-Site Request Forgery to Remote Code Execution

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-9890
Patch Status
Patched
Published
Oct 17, 2025
Affected Software
Theme Editor
Researcher
More Details >

Voice Feedback – Voice Recorder for Audio Feedback <= 1.0.3 – Authenticated (Subscriber+) Privilege Escalation

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-62007
Patch Status
Patched
Published
Oct 16, 2025
Affected Software
Voice Feedback – Voice Recorder for Audio Feedback
Researcher
More Details >

WPBifröst – Instant Passwordless Temporary Login Links <= 1.0.7 – Missing Authorization to Authenticated (Subscriber+) Privilege Escalation

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-10299
Patch Status
Patched
Published
Oct 14, 2025
Affected Software
WPBifröst – Instant Passwordless Temporary Login Links
Researcher
More Details >

XStore | Multipurpose WooCommerce Theme <= 9.5.4 – Authenticated (Subscriber+) Local File Inclusion

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-11746
Patch Status
Patched
Published
Oct 14, 2025
Affected Software
XStore
Researcher
More Details >

Category and Products Accordion Panel <= 1.0 – Authenticated (Contributor+) Local File Inclusion

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2025-11722
Patch Status
Unpatched
Published
Oct 14, 2025
Affected Software
Woocommerce Category and Products Accordion Panel
Researcher
More Details >

Dynamically Display Posts <= 1.1 – Unauthenticated SQL Injection

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2025-11501
Patch Status
Unpatched
Published
Oct 14, 2025
Affected Software
Dynamically Display Posts
Researcher
More Details >

Event Tickets and Registration <= 5.26.5 – Unauthenticated Ticket Payment Bypass

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2025-11517
Patch Status
Patched
Published
Oct 17, 2025
Affected Software
Event Tickets and Registration
Researcher
More Details >

External Login <= 1.11.2 – Unauthenticated SQL Injection via log

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2025-11177
Patch Status
Unpatched
Published
Oct 14, 2025
Affected Software
External Login
Researcher
More Details >

Free Follow-Up Emails & Marketing Automation for WooCommerce – ShopMagic <= 4.5.6 – Unauthenticated Information Exposure

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2025-59578
Patch Status
Patched
Published
Oct 15, 2025
Affected Software
Free Follow-Up Emails & Marketing Automation for WooCommerce – ShopMagic
Researcher
More Details >

HiStudy – Online Courses & Education Template < 3.1.0 – Unauthenticated SQL Injection

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2025-48089
Patch Status
Patched
Published
Oct 13, 2025
Affected Software
HiStudy – Online Courses & Education Template
Researcher
More Details >

HiStudy – Online Courses & Education Template < 3.1.0 – Unauthenticated SQL Injection

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2025-48089
Patch Status
Patched
Published
Oct 13, 2025
Affected Software
HiStudy – Online Courses & Education Template
Researcher
More Details >

Houzez Theme – Functionality <= 4.1.8 – Authenticated (Contributor+) Local File Inclusion

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2025-62054
Patch Status
Patched
Published
Oct 16, 2025
Affected Software
Houzez Theme – Functionality
Researcher
More Details >

Outdoor <= 1.3.2 – Unauthenticated SQL Injection

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2025-10743
Patch Status
Unpatched
Published
Oct 14, 2025
Affected Software
Outdoor
Researcher
More Details >

PPOM – Product Addons & Custom Fields for WooCommerce <= 33.0.15 – Unauthenticated SQL Injection

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2025-11691
Patch Status
Patched
Published
Oct 17, 2025
Affected Software
PPOM – Product Addons & Custom Fields for WooCommerce
Researcher
More Details >

Product Table For WooCommerce <= 1.2.4 – Authenticated (Contributor+) PHP Object Injection

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2025-62008
Patch Status
Patched
Published
Oct 16, 2025
Affected Software
Product Table For WooCommerce
Researcher
More Details >

Lisfinity Core – Lisfinity Core plugin used for pebas® Lisfinity WordPress theme <= 1.4.0 – Unauthenticated Privilege Escalation to Editor

7.3
CVSS Rating
High (7.3)
CVE-ID
CVE-2025-6042
Patch Status
Patched
Published
Oct 14, 2025
Affected Software
Lisfinity Core – Lisfinity Core plugin used for pebas® Lisfinity WordPress theme
Researcher
More Details >

Demo Import Kit <= 1.1.0 – Authenticated (Admin+) Arbitrary File Upload

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2025-10051
Patch Status
Unpatched
Published
Oct 14, 2025
Affected Software
Demo Import Kit
Researcher
More Details >

DocoDoco Store Locator <= 1.0.1 – Authenticated (Editor+) Arbitrary File Upload

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2025-10754
Patch Status
Unpatched
Published
Oct 14, 2025
Affected Software
DocoDoco Store Locator
Researcher
More Details >

Find And Replace content for WordPress <= 1.1 – Missing Authorization to Unauthenticated Stored Cross-Site Scripting

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2025-10313
Patch Status
Unpatched
Published
Oct 14, 2025
Affected Software
Find And Replace content for WordPress
Researcher
More Details >

Binary MLM Plan <= 3.0 – Unauthenticated Limited Privilege Escalation

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2025-10038
Patch Status
Unpatched
Published
Oct 14, 2025
Affected Software
Binary MLM Plan
Researcher
More Details >

LearnPress – WordPress LMS Plugin <= 4.2.9.3 – Missing Authorization to Unauthenticated Database Table Manipulation

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2025-11372
Patch Status
Patched
Published
Oct 17, 2025
Affected Software
LearnPress – WordPress LMS Plugin
Researcher
More Details >

TARIFFUXX <= 1.4 – Authenticated (Contributor+) SQL Injection via tariffuxx_configurator Shortcode

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2025-10682
Patch Status
Unpatched
Published
Oct 14, 2025
Affected Software
TARIFFUXX
Researcher
More Details >

WP Dashboard Chat <= 1.0.3 – Authenticated (Contributor+) SQL Injection via id

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2025-10660
Patch Status
Unpatched
Published
Oct 14, 2025
Affected Software
WP Dashboard Chat
Researcher
More Details >

WP Google Map Plugin <= 1.0 – Authenticated (Contributor+) SQL Injection

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2025-11365
Patch Status
Unpatched
Published
Oct 14, 2025
Affected Software
WP Google Map Plugin
Researcher
More Details >

WP jQuery Pager <= 1.4.0 – Authenticated (Contributor+) SQL Injection via Shortcode

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2025-10575
Patch Status
Unpatched
Published
Oct 14, 2025
Affected Software
WP jQuery Pager
Researcher
More Details >

Wp tabber widget <= 4.0 – Authenticated (Contributor+) SQL Injection

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2025-10730
Patch Status
Unpatched
Published
Oct 14, 2025
Affected Software
Wp tabber widget
Researcher
More Details >

Dhivehi Text <= 0.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-10132
Patch Status
Unpatched
Published
Oct 14, 2025
Affected Software
Dhivehi Text
Researcher
More Details >

Digiseller <= 1.3.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-10141
Patch Status
Unpatched
Published
Oct 14, 2025
Affected Software
Digiseller
Researcher
More Details >

e2pdf <= 1.28.09 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-62068
Patch Status
Patched
Published
Oct 16, 2025
Affected Software
E2Pdf – Export Pdf Tool for WordPress
Researcher
More Details >

Essential Blocks <= 5.7.1 – Authenticated (Author+) Server-Side Request Forgery

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-11361
Patch Status
Patched
Published
Oct 17, 2025
Affected Software
Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns
Researcher
More Details >

Event post <= 5.10.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-62042
Patch Status
Patched
Published
Oct 16, 2025
Affected Software
Event post
Researcher
More Details >

Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns <= 5.7.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-11270
Patch Status
Patched
Published
Oct 17, 2025
Affected Software
Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns
Researcher
More Details >

Houzez Theme – Functionality < 4.2.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-62058
Patch Status
Patched
Published
Oct 16, 2025
Affected Software
Houzez Theme – Functionality
Researcher
More Details >

MDTF <= 1.3.3.8 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-62069
Patch Status
Patched
Published
Oct 16, 2025
Affected Software
MDTF – Meta Data and Taxonomies Filter
Researcher
More Details >

Ova Advent <= 1.1.7 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-8561
Patch Status
Patched
Published
Oct 14, 2025
Affected Software
Ova Advent
Researcher
More Details >

Pie Calendar <= 1.2.9 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-62024
Patch Status
Patched
Published
Oct 16, 2025
Affected Software
Events Calendar Made Simple – Pie Calendar
Researcher
More Details >

Quick Social Login <= 1.4.6 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-10140
Patch Status
Unpatched
Published
Oct 14, 2025
Affected Software
Quick Social Login
Researcher
More Details >

Redirection for Contact Form 7 <= 3.2.6 – Authenticated (Contributor+) Stored Cross-Site Scripting via qs_date Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-9562
Patch Status
Patched
Published
Oct 17, 2025
Affected Software
Redirection for Contact Form 7
Researcher
More Details >

Shortcode Button <= 1.1.9 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-10194
Patch Status
Unpatched
Published
Oct 14, 2025
Affected Software
Shortcode Button
Researcher
More Details >

Tab Ultimate <= 1.8 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-62060
Patch Status
Patched
Published
Oct 16, 2025
Affected Software
Tab Ultimate
Researcher
More Details >

tagDiv Cloud Library <= 3.9 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-62032
Patch Status
Patched
Published
Oct 16, 2025
Affected Software
tagDiv Cloud Library
Researcher
More Details >

tagDiv Composer <= 5.4.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-62030
Patch Status
Patched
Published
Oct 16, 2025
Affected Software
tagDiv Composer
Researcher
More Details >

TheGem Theme Elements (for WPBakery) <= 5.10.5.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-62044
Patch Status
Patched
Published
Oct 16, 2025
Affected Software
thegem-elements
Researcher
More Details >

UDesign Core <= 4.14.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-62051
Patch Status
Patched
Published
Oct 16, 2025
Affected Software
u-design-core
Researcher
More Details >

URLYar <= 1.1.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-10133
Patch Status
Unpatched
Published
Oct 14, 2025
Affected Software
URLYar URL Shortner
Researcher
More Details >

WP BookWidgets <= 0.9 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-10139
Patch Status
Patched
Published
Oct 14, 2025
Affected Software
WP BookWidgets
Researcher
More Details >

WP Travel Gutenberg Blocks <= 3.9.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-62063
Patch Status
Patched
Published
Oct 16, 2025
Affected Software
WP Travel Gutenberg Blocks
Researcher
More Details >

WP ViewSTL <= 1.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-10135
Patch Status
Unpatched
Published
Oct 14, 2025
Affected Software
WP ViewSTL
Researcher
More Details >

WPBakery Page Builder <= 8.6 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-10006
Patch Status
Patched
Published
Oct 17, 2025
Affected Software
WPBakery Page Builder
Researcher
More Details >

WPBakery Page Builder <= 8.6.1 – Stored Cross-Site Scripting via Custom JS Module

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-11160
Patch Status
Patched
Published
Oct 14, 2025
Affected Software
WPBakery Page Builder
Researcher
More Details >

WPBakery Page Builder <= 8.6.1 – Stored Cross-Site Scripting via vc_custom_heading Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-11161
Patch Status
Patched
Published
Oct 14, 2025
Affected Software
WPBakery Page Builder
Researcher
More Details >

WPCasa <= 1.4.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-62043
Patch Status
Patched
Published
Oct 16, 2025
Affected Software
WPCasa
Researcher
More Details >

XX2WP Integration Tools <= 1.9.9 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-11857
Patch Status
Patched
Published
Oct 17, 2025
Affected Software
XX2WP Integration Tools
Researcher
More Details >

ShortPixel Image Optimizer <= 6.3.4 – Authenticated (Contributor+) Settings Import/Export

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2025-11378
Patch Status
Patched
Published
Oct 17, 2025
Affected Software
ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF
Researcher
More Details >

Content Writer <= 3.6.8 – Unauthenticated Information Exposure via Log File

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-10486
Patch Status
Patched
Published
Oct 14, 2025
Affected Software
Content Writer
Researcher
More Details >

Easy Post Submission <= 1.7.0 – Unauthenticated Sensitive Information Exposure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-62062
Patch Status
Patched
Published
Oct 16, 2025
Affected Software
Easy Post Submission – Frontend Posting, Guest Publishing & Submit Content for WordPress
Researcher
More Details >

Felan Framework <= 1.1.4 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Activation/Deactivation via process_plugin_actions

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-10849
Patch Status
Patched
Published
Oct 15, 2025
Affected Software
Felan Framework
Researcher
More Details >

Kallyas <= 4.22.0 – Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-62018
Patch Status
Patched
Published
Oct 16, 2025
Affected Software
KALLYAS – Creative eCommerce Multi-Purpose WordPress Theme
Researcher
More Details >

Kognetiks Chatbot <= 2.3.5 – Missing Authorization to Unauthenticated Limited File Uploads and Conversation Erasing

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-11256
Patch Status
Patched
Published
Oct 17, 2025
Affected Software
Kognetiks Chatbot
Researcher
More Details >

Login with YourMembership – YM SSO Login <= 1.1.7 – Missing Authorization to Unauthenticated Sensitive Information Exposure via ‘moym_display_test_attributes’

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-10648
Patch Status
Unpatched
Published
Oct 14, 2025
Affected Software
YourMembership Single Sign On – YM SSO Login
Researcher
More Details >

Media Library Assistant <= 3.29 – Unauthenticated Limited File Read

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-11738
Patch Status
Patched
Published
Oct 17, 2025
Affected Software
Media Library Assistant
Researcher
More Details >

Oceanpayment CreditCard Gateway <= 6.0 – Missing Authentication to Unauthenticated Order Status Update

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-11728
Patch Status
Unpatched
Published
Oct 14, 2025
Affected Software
Oceanpayment CreditCard Gateway
Researcher
More Details >

PowerBI Embed Reports <= 1.2.0 – Unauthenticated Sensitive Information Disclosure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-10750
Patch Status
Patched
Published
Oct 17, 2025
Affected Software
PowerBI Embed Reports
Researcher
More Details >

Simple Job Board <= 2.13.7 – Unauthenticated Sensitive Information Exposure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-59579
Patch Status
Patched
Published
Oct 14, 2025
Affected Software
Simple Job Board
Researcher
More Details >

WhyDonate – FREE Donate button – Crowdfunding – Fundraising <= 4.0.15 – Missing Authorization to Unauthenticated wp_wdplugin_style Rww Deletion

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-10186
Patch Status
Patched
Published
Oct 14, 2025
Affected Software
WhyDonate – FREE Donate button – Crowdfunding – Fundraising
Researcher
More Details >

WP Go Maps (formerly WP Google Maps) <= 9.0.48 – Unauthenticated Cache Poisoning

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-11703
Patch Status
Patched
Published
Oct 17, 2025
Affected Software
WP Go Maps (formerly WP Google Maps)
Researcher
More Details >

WPC Smart Quick View for WooCommerce <= 4.2.5 – Insecure Direct Object Reference to Unauthenticated Private Product Exposure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-11741
Patch Status
Patched
Published
Oct 17, 2025
Affected Software
WPC Smart Quick View for WooCommerce
Researcher
More Details >

Zip Attachments <= 1.6 – Missing Authorization to Limited File Deletion

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-11692
Patch Status
Unpatched
Published
Oct 14, 2025
Affected Software
Zip Attachments
Researcher
More Details >

Zip Attachments <= 1.6 – Missing Authorization to Unauthenticated Private And Password-Protected Posts Attachment Disclosure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-11701
Patch Status
Unpatched
Published
Oct 14, 2025
Affected Software
Zip Attachments
Researcher
More Details >

Advanced Coupons for WooCommerce Coupons <= 4.6.8 – Authenticated (Shop manager+) SQL Injection

4.9
CVSS Rating
Medium (4.9)
CVE-ID
CVE-2025-62015
Patch Status
Patched
Published
Oct 16, 2025
Affected Software
Advanced Coupons – WooCommerce Coupons & Store Credit
Researcher
More Details >

GSpeech TTS – WordPress Text To Speech Plugin <= 3.17.13 – Authenticated (Admin+) SQL injection

4.9
CVSS Rating
Medium (4.9)
CVE-ID
CVE-2025-10187
Patch Status
Patched
Published
Oct 17, 2025
Affected Software
GSpeech TTS – WordPress Text To Speech Plugin
Researcher
More Details >

onOffice for WP-Websites <= 5.7 – Authenticated (Editor+) SQL Injection

4.9
CVSS Rating
Medium (4.9)
CVE-ID
CVE-2025-10045
Patch Status
Unpatched
Published
Oct 14, 2025
Affected Software
onOffice for WP-Websites
Researcher
More Details >

Rich Snippet Site Report <= 2.0.0105 – Authenticated (Admin+) SQL Injection

4.9
CVSS Rating
Medium (4.9)
CVE-ID
CVE-2025-10310
Patch Status
Unpatched
Published
Oct 14, 2025
Affected Software
Rich Snippet Site Report
Researcher
More Details >

Related Posts Lite <= 1.12 – Authenticated (Admin+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2025-11926
Patch Status
Unpatched
Published
Oct 17, 2025
Affected Software
Related Posts Lite
Researcher
More Details >

Task Scheduler <= 1.6.3 – Authenticated (Admin+) Blind Server-Side Request Forgery

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2025-10056
Patch Status
Unpatched
Published
Oct 14, 2025
Affected Software
Task Scheduler
Researcher
More Details >

Acknowledgify <= 1.1.3 – Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-62021
Patch Status
Patched
Published
Oct 16, 2025
Affected Software
Acknowledgify
Researcher
More Details >

Ally – Web Accessibility & Usability <= 3.8.0 – Cross-Site Request Forgery to Plugin Settings Update

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-10700
Patch Status
Patched
Published
Oct 15, 2025
Affected Software
Ally – Web Accessibility & Usability
Researcher
More Details >

Binary MLM Plan <= 3.0 – Authenticated (Subscriber+) Insecure Direct Object Reference

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-11895
Patch Status
Unpatched
Published
Oct 16, 2025
Affected Software
Binary MLM Plan
Researcher
More Details >

Block Country <= 1.0 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-48077
Patch Status
Unpatched
Published
Oct 13, 2025
Affected Software
Block Country
Researcher
More Details >

Blockspare <= 3.2.13.2 – Authenticated (Contributor+) Sensitive Information Exposure

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-62026
Patch Status
Patched
Published
Oct 16, 2025
Affected Software
BlockSpare — News, Magazine and Blog Addons for (Gutenberg) Block Editor
Researcher
More Details >

Event Tickets <= 5.26.3 – Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-62027
Patch Status
Patched
Published
Oct 16, 2025
Affected Software
Event Tickets and Registration
Researcher
More Details >

External Login <= 1.11.2 – Authenticated (Subscriber+) Sensitive Data Exposure via Test Connection

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-11196
Patch Status
Unpatched
Published
Oct 14, 2025
Affected Software
External Login
Researcher
More Details >

FileBird <= 6.4.9 – Improper Authorization to Authenticated (Author+) Settings Reset

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-11510
Patch Status
Patched
Published
Oct 17, 2025
Affected Software
FileBird – WordPress Media Library Folders & File Manager
Researcher
More Details >

Front End Users <= 3.2.33 – Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-62072
Patch Status
Patched
Published
Oct 16, 2025
Affected Software
Front End Users
Researcher
More Details >

FunKItools <= 1.0.2 – Cross-Site Request Forgery to Settings Update

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-10301
Patch Status
Unpatched
Published
Oct 14, 2025
Affected Software
FunKItools
Researcher
More Details >

HomeLancer <= 1.0.1 – Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-49375
Patch Status
Patched
Published
Oct 16, 2025
Affected Software
HomeLancer
Researcher
More Details >

Image optimization service by Optimole <= 4.1.0 – Insecure Direct Object Reference to Authenticated (Author+) Media Offload

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-11519
Patch Status
Patched
Published
Oct 17, 2025
Affected Software
Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization
Researcher
More Details >

Kallyas <= 4.22.0 – Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-62017
Patch Status
Patched
Published
Oct 16, 2025
Affected Software
KALLYAS – Creative eCommerce Multi-Purpose WordPress Theme
Researcher
More Details >

Library Management System <= 3.1 – Missing Authorization to Authenticated (Subscriber+) Settings Manipulation

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-10303
Patch Status
Patched
Published
Oct 14, 2025
Affected Software
Library Management System
Researcher
More Details >

MasterStudy LMS <= 3.6.20 – Authenticated (Instructor+) Sensitive Information Exposure

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-59575
Patch Status
Patched
Published
Oct 16, 2025
Affected Software
MasterStudy LMS WordPress Plugin – for Online Courses and Education
Researcher
More Details >

MeetingHub <= 1.23.9 – Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-62073
Patch Status
Patched
Published
Oct 16, 2025
Affected Software
MeetingHub for Zoom Meeting, Google Meet, Jitsi Meet, Webex, & Microsoft Teams | The All-in-One Webinar & Video Conference Solution
Researcher
More Details >

One Page Express Companion <= 1.6.43 – Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-62052
Patch Status
Patched
Published
Oct 16, 2025
Affected Software
One Page Express Companion
Researcher
More Details >

Product Catalog Simple <= 1.8.4 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-62061
Patch Status
Patched
Published
Oct 16, 2025
Affected Software
Product Catalog Simple
Researcher
More Details >

Quick Featured Images <= 13.7.2 – Insecure Direct Object Reference to Image Manipulation

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-11176
Patch Status
Patched
Published
Oct 14, 2025
Affected Software
Quick Featured Images
Researcher
More Details >

replyMail <= 1.2.0 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-31029
Patch Status
Unpatched
Published
Oct 14, 2025
Affected Software
replyMail
Researcher
More Details >

Salient < 17.4.0 – Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-62028
Patch Status
Patched
Published
Oct 16, 2025
Affected Software
Salient | Creative Multipurpose & WooCommerce Theme
Researcher
More Details >

Simple Stripe <= 0.9.17 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-48085
Patch Status
Unpatched
Published
Oct 13, 2025
Affected Software
Simple Stripe
Researcher
More Details >

Slick Google Map <= 0.3 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-48078
Patch Status
Unpatched
Published
Oct 13, 2025
Affected Software
Slick Google Map
Researcher
More Details >

SmartCrawl <= 3.14.3 – Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-62048
Patch Status
Patched
Published
Oct 16, 2025
Affected Software
SmartCrawl SEO checker, analyzer & optimizer
Researcher
More Details >

Social proof testimonials and reviews by Repuso <= 5.29 – Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-62071
Patch Status
Patched
Published
Oct 16, 2025
Affected Software
Reviews Widgets for Google & 45+ platforms by Repuso
Researcher
More Details >

SUMO Memberships for WooCommerce < 7.8.0 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-62005
Patch Status
Patched
Published
Oct 15, 2025
Affected Software
SUMO Memberships for WooCommerce
Researcher
More Details >

SureForms – Drag and Drop Form Builder for WordPress <= 1.12.1 – Missing Authorization to Authenticated (Contributor+) Information Disclosure

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-10732
Patch Status
Patched
Published
Oct 13, 2025
Affected Software
SureForms – Drag and Drop Contact Form Builder – Multi-step Forms, Conversational Forms and more
Researcher
More Details >

Theme Importer <= 1.0 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-10312
Patch Status
Unpatched
Published
Oct 14, 2025
Affected Software
Theme Importer
Researcher
More Details >

TopBar <= 1.0.0 – Cross-Site Request Forgery to Settings Update

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-10300
Patch Status
Unpatched
Published
Oct 14, 2025
Affected Software
TopBar
Researcher
More Details >

UiChemy <= 4.0.0 – Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-62013
Patch Status
Patched
Published
Oct 16, 2025
Affected Software
UiChemy — Figma Converter for Elementor, Gutenberg and Bricks
Researcher
More Details >

UPC/EAN/GTIN Code Generator <= 2.0.2 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-62009
Patch Status
Patched
Published
Oct 16, 2025
Affected Software
UPC/EAN/GTIN Barcode Generator/Importer
Researcher
More Details >

WowRevenue <= 1.2.13 – Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-62070
Patch Status
Patched
Published
Oct 16, 2025
Affected Software
Product Bundles, Quantity/Bulk Discount, BOGO, Buy X Get Y – WowRevenue
Researcher
More Details >

WP SMS <= 7.0.1 – Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-62006
Patch Status
Patched
Published
Oct 16, 2025
Affected Software
WP SMS – Ultimate SMS & MMS Notifications, OTP, 2FA, and WooCommerce & Forms Integrations
Researcher
More Details >

WPC Smart Wishlist for WooCommerce <= 5.0.4 – Missing Authorization to Authenticated (Subscriber+) Information Exposure

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-11742
Patch Status
Patched
Published
Oct 17, 2025
Affected Software
WPC Smart Wishlist for WooCommerce
Researcher
More Details >

wpNamedUsers <= 0.5 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-48083
Patch Status
Unpatched
Published
Oct 13, 2025
Affected Software
wpNamedUsers
Researcher
More Details >

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

The post Wordfence Intelligence Weekly WordPress Vulnerability Report (October 13, 2025 to October 19, 2025) appeared first on Wordfence.

Leave a Comment