Wordfence Intelligence Weekly WordPress Vulnerability Report (May 5, 2025 to May 11, 2025)

by

📢 In case you missed it, Wordfence just published its annual WordPress security report for 2024. Read it now to learn more about the evolving risk landscape of WordPress so you can keep your sites protected in 2025 and beyond.  

Last week, there were 222 vulnerabilities disclosed in 202 WordPress Plugins and 2 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 66 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back.

Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 26,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

New Firewall Rules Deployed Last Week

The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.

The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:

  • TheGem <= 5.10.3 – Authenticated (Subscriber+) Arbitrary File Upload
  • WAF-RULE-827 – Data redacted while we work with the vendor on a patch.
  • WAF-RULE-829 – Data redacted while we work with the vendor on a patch.
  • WAF-RULE-830 – Data redacted while we work with the vendor on a patch.
  • WAF-RULE-831 – Data redacted while we work with the vendor on a patch.

Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.

Total Unpatched & Patched Vulnerabilities Last Week

Patch Status Number of Vulnerabilities
Patched 132
Unpatched 90

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating Number of Vulnerabilities
Low Severity 1
Medium Severity 166
High Severity 39
Critical Severity 16

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE Number of Vulnerabilities
Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) 77
Cross-Site Request Forgery (CSRF) 41
Missing Authorization 26
Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’) 12
Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) 11
Unrestricted Upload of File with Dangerous Type 9
Server-Side Request Forgery (SSRF) 7
Authorization Bypass Through User-Controlled Key 6
Improper Control of Generation of Code (‘Code Injection’) 5
Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) 5
Deserialization of Untrusted Data 4
URL Redirection to Untrusted Site (‘Open Redirect’) 4
Authentication Bypass Using an Alternate Path or Channel 3
Exposure of Sensitive Information to an Unauthorized Actor 3
Improper Authorization 3
Improper Privilege Management 2
Concurrent Execution using Shared Resource with Improper Synchronization (‘Race Condition’) 1
External Control of File Name or Path 1
Incorrect Authorization 1
Unverified Password Change 1

Researchers That Contributed to WordPress Security Last Week

Researcher Name Number of Vulnerabilities
33
28
16
10
10
8
7
6
6
5
5
5
4
4
4
3
3
3
3
3
2
2
2
2
2
2
2
2
2
2
2
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name Software Slug
1 Click WordPress Migration Plugin – 100% FREE for a limited time 1-click-migration
A WordPress Testimonial Plugin to Showcase Testimonial Slider, Testimonial Grid and More: Solid Testimonials gs-testimonial
aBlocks – WordPress Gutenberg Blocks ablocks
Accept Donations with PayPal & Stripe easy-paypal-donation
Advanced File Manager — Ultimate WordPress File Manager and Document Library Plugin file-manager-advanced
AHAthat Plugin ahathat
AI Power: Complete AI Pack gpt3-ai-content-generator
Ajar in5 Embed ajar-productions-in5-embed
Amazon Product in a Post Plugin amazon-product-in-a-post-plugin
AWEOS WP Lock aweos-wp-lock
Awesome Gallery awesome-gallery
Awin – Advertiser Tracking for WooCommerce awin-advertiser-tracking
Beacon Lead Magnets and Lead Capture beacon-by
Beds24 Online Booking beds24-online-booking
belingoGeo belingogeo
Better Search – Relevant search results for WordPress better-search
BlockSpare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites – Post Grids, Sliders, Carousels, Counters, Page Builder & Starter Site Imports, No Coding Needed blockspare
BMI Adult & Kid Calculator bmi-adultkid-calculator
Bold Page Builder bold-page-builder
BuddyBoss Platform Pro buddyboss-platform-pro
Bulk Featured Image bulk-featured-image
Calculate Prices based on Distance For WooCommerce calculate-prices-based-on-distance-for-woocommerce
CarDealerPress cardealerpress
Cart tracking for WooCommerce cart-tracking-for-woocommerce
CBX Map for Google Map & OpenStreetMap cbxgooglemap
CC BMI Calculator cc-bmi-calculator
Challan – PDF Invoice & Packing Slip for WooCommerce webappick-pdf-invoice-for-woocommerce
Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More charitable
Cision Block cision-block
ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages clickwhale
Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors publishpress-authors
CoinPayments.net Payment Gateway for WooCommerce coinpayments-payment-gateway-for-woocommerce
Color Your Bar color-your-bar
Contact Form 7 – PayPal & Stripe Add-on contact-form-7-paypal-add-on
Contact Form Widget – Contact Query, Contact Page, Form Maker, Query Table new-contact-form-widget
Content Control – The Ultimate Content Restriction Plugin! Restrict Content, Create Conditional Blocks & More content-control
ContentStudio contentstudio
Contextual Related Posts contextual-related-posts
Contribuinte Checkout contribuinte-checkout
CookieCode cookiecode
Cool Author Box – For Widget and Post Content hm-cool-author-box-widget
Cost Calculator for Elementor cost-calculator-for-elementor
Countdown Timer – Widget Countdown widget-countdown
Cozy Blocks – Page Builder for Gutenberg & Site Editor with Post Blocks, WooCommerce Blocks, Magazine Blocks & WordPress Gutenberg Blocks cozy-addons
Credova Financial credova-financial
Custom Checkout Fields for WooCommerce custom-checkout-fields-for-woocommerce
DELUCKS SEO delucks-seo
Display Eventbrite Events widget-for-eventbrite-api
Display Remote Posts Block display-remote-posts-block
DoFollow Case by Case dofollow-case-by-case
Download Manager and Payment Form WordPress Plugin – WP SmartPay smartpay
Download Monitor download-monitor
Drag and Drop Multiple File Upload for WooCommerce drag-and-drop-multiple-file-upload-for-woocommerce
Dynamic Pricing With Discount Rules for WooCommerce aco-woo-dynamic-pricing
Easy PayPal & Stripe Buy Now Button wp-ecommerce-paypal
Easy PayPal Events & Tickets easy-paypal-events-tickets
Easy Replace Image easy-replace-image
EasyMe Connect easyme-connect
Ebook Store ebook-store
ELEX Product Feed for WooCommerce elex-product-feed
ELEX WordPress HelpDesk & Customer Ticketing System elex-helpdesk-customer-support-ticket-system
Email Marketing, Email Automation, Newsletter & Cart Abandonment for WordPress and WooCommerce – Mail Mint mail-mint
Email Notification on Login email-notification-on-login
Envo Extra envo-extra
Envolve Plugin envolve-plugin
EUCookieLaw eucookielaw
Event Manager, Events Calendar, Tickets, Registrations – Eventin wp-event-solution
EventON – Events Calendar eventon-lite
External image replace external-image-replace
EZ Related Posts Footer Links and Widget spostarbust
Frontend Dashboard frontend-dashboard
Frontend Login and Registration Blocks frontend-login-and-registration-blocks
FundEngine – Donation and Crowdfunding Platform wp-fundraising-donation
FunnelCockpit funnelcockpit
GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress gamipress
Graphina – Elementor Charts and Graphs graphina-elementor-charts-and-graphs
GS Variation Swatches for WooCommerce gs-woo-variation-swatches
Guest posting / Frontend Posting / Front Editor – WP Front User Submit front-editor
Hash Form – Drag & Drop Form Builder hash-form
Hotel Booking nd-booking
IMITHEMES Listing imithemes-listing
Inline Related Posts intelly-related-posts
Instantio – WooCommerce Quick Checkout | Direct Checkout, Floating Cart, Side Cart & Popup Cart instantio
Integration for WooCommerce and Salesforce woo-salesforce-plugin-crm-perks
Integrations of Zoho CRM with Elementor form integrations-of-zoho-crm-with-elementor-form
Jeg Elementor Kit jeg-elementor-kit
Jupiter X Core jupiterx-core
LayoutBoxx layoutboxx
Lead Form Data Collection to CRM wp-leads-builder-any-crm
Legal Terms and Conditions Popup for User Login and WooCommerce Checkout – TPUL terms-popup-on-user-login
LessButtons Social Sharing and Statistics lessbuttons
List category posts list-category-posts
Listamester listamester
LiteSpeed Cache litespeed-cache
LiveAgent – Omnichannel Help Desk & Live Chat Software liveagent
LocateAndFilter locateandfilter
Login Lockdown & Protection login-lockdown
Logo Showcase logo-showcase
Martins Free Monetized Ad Exchange Network – Get more website visitors martins-free-and-easy-ad-network-get-more-visitors
Media Hygiene: Remove or Delete Unused Images and More! media-hygiene
Meks Flexible Shortcodes meks-flexible-shortcodes
Meow Gallery meow-gallery
Mollie Forms mollie-forms
Multiple Post Type Order multiple-post-type-order
Music Player for WooCommerce music-player-for-woocommerce
N360 | Splash Screen n360-splash-screen
NEX-Forms – Ultimate Forms Plugin for WordPress nex-forms-express-wp-form-builder
NGG Smart Image Search ngg-smart-image-search
Open Close WooCommerce Store – Best Business Schedules Manager woc-open-close
Ovation Elements ovation-elements
Pays – WooCommerce Payment Gateway axima-payment-gateway
PDF for WooCommerce – ALL in One + Drag And Drop Template Builder pdf-for-woocommerce
PeproDev Ultimate Profile Solutions peprodev-ups
PGS Core pgs-core
Photo Gallery – GT3 Image Gallery & Gutenberg Block Gallery gt3-photo-video-gallery
Photo Gallery, Images, Slider in Rbs Image Gallery robo-gallery
Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons contest-gallery
Poll Maker – Versus Polls, Anonymous Polls, Image Polls poll-maker
Popup and Slider Builder by Depicter – Add Email collecting Popup, Popup Modal, Coupon Popup, Image Slider, Carousel Slider, Post Slider Carousel depicter
Product Quantity Dropdown For Woocommerce product-quantity-dropdown-for-woocommerce
Product Time Countdown for WooCommerce product-countdown-for-woocommerce
Productive Commerce – WooCommerce Wishlist, Compare, Quick View, & MiniCart productive-commerce
Progress Bar progress-bar
PSW Front-end Login & Registration psw-login-and-registration
PW WooCommerce Bulk Edit pw-bulk-edit
QS Dark Mode Plugin qs-dark-mode
Quran multilanguage Text & Audio quran-text-multilanguage
Reales WP STPT short-tax-post
Really Simple Under Construction Page really-simple-under-construction
Relevanssi – A Better Search relevanssi
Relevanssi – A Better Search (Pro) relevanssi-premium
Responsive Plus – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme. responsive-add-ons
Royal Elementor Addons and Templates royal-elementor-addons
RS WP Book Showcase – A Complete Book Catalogue & Library System rs-wp-books-showcase
Search Exclude search-exclude
SendPulse Email Marketing Newsletter sendpulse-email-marketing-newsletter
Seznam Webmaster seznam-webmaster
Show All Comments show-all-comments-in-one-page
Sidebar Manager Light sidebar-manager-light
Simple Blog Stats simple-blog-stats
Simple calendar for Elementor simple-calendar-for-elementor
Simple File List simple-file-list
Simple Giveaways – Grow your business, email lists and traffic with contests giveasap
SKT Skill Bar skt-skill-bar
Smaily for WP smaily-for-wp
SMS Alert Order Notifications – WooCommerce sms-alert
Soccer Live Scores soccer-live-scores
Solace Extra solace-extra
Spiraclethemes Site Library spiraclethemes-site-library
StoreKeeper for WooCommerce storekeeper-for-woocommerce
Submission DOM tracking for Contact Form 7 cf7-submission-dom-tracking
Supertext Translation and Proofreading polylang-supertext
tagDiv Composer td-composer
theMarketer – Email marketing, Newsletters, Automation & Loyalty for Woocommerce themarketer
Time Clock – A WordPress Employee & Volunteer Time Clock Plugin time-clock
Top 10 – WordPress Popular posts by WebberZone top-10
TrackShip for WooCommerce trackship-for-woocommerce
TrueBooker – Appointment Booking and Scheduler Plugin. truebooker-appointment-booking
Ultimate Before After Image Slider & Gallery – BEAF beaf-before-and-after-gallery
Ultimate Blocks – WordPress Blocks Plugin ultimate-blocks
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin ultimate-member
Ultimate WP Mail ultimate-wp-mail
Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin uncanny-automator
User Login History user-login-history
User Registration & Membership – Custom Registration Form, Login Form, and User Profile user-registration
Wbcom Designs – Activity Link Preview For BuddyPress activity-link-preview-for-buddypress
Web Accessibility with Max Access accessibility-toolbar
Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode coming-soon
weMail – Email Marketing, Lead Generation, Optin Forms, Email Newsletters, A/B Testing, and Automation wemail
Wiki Embed wiki-embed
Woobox woobox
Woocommerce Multiple Addresses woocommerce-multiple-addresses
WordPress CRM Plugin – WP-CRM System wp-crm-system
WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg groundhogg
WordPress Infinite Scroll – Ajax Load More ajax-load-more
WordPress Review Plugin: The Ultimate Solution for Building a Review Website wp-review
WordPress Webinar Plugin – WebinarPress wp-webinarsystem
WP Compress – Instant Performance & Speed Optimization wp-compress-image-optimizer
WP Discord Invite wp-discord-invite
WP DPE-GES wp-dpe-ges
WP Gravity Forms Dynamics CRM gf-dynamics-crm
WP Gravity Forms Zendesk gf-zendesk
WP Hotel Booking wp-hotel-booking
WP Job Portal – A Complete Recruitment System for Company or Job Board website wp-job-portal
WP jQuery DataTable wp-jquery-datatable
WP Maintenance wp-maintenance
WP Pipes wp-pipes
WP Podcasts Manager wp-podcasts-manager
WP SEO Structured Data Schema wp-seo-structured-data-schema
WP-Recall – Registration, Profile, Commerce & More wp-recall
WPAdverts – Classifieds Plugin wpadverts
WPBakery Visual Composer WHMCS Elements void-visual-whmcs-element
WPBookit wpbookit
WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More wpforms-lite
WPshop 2 – E-Commerce wpshop
WPSpeed wpspeed
WZ Followed Posts – Display what visitors are reading where-did-they-go-from-here
Xavin’s List Subpages xavins-list-subpages
xili-tidy-tags xili-tidy-tags
XT Event Widget for Social Events xt-facebook-events
YaySMTP and Email Logs: Amazon SES, SendGrid, Outlook, Mailgun, Brevo, Google and Any SMTP Service yaysmtp
워드프레스 결제 심플페이 – 우커머스 결제 플러그인 pgall-for-woocommerce

WordPress Themes with Reported Vulnerabilities Last Week

Software Name Software Slug
Blocksy blocksy
Wolmart | Multi-Vendor Marketplace WooCommerce Theme wolmart

Vulnerability Details

Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.

Ajar in5 Embed <= 3.1.5 – Unauthenticated Arbitrary File Upload

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-47642
Patch Status
Unpatched
Published
May 9, 2025
Affected Software
Ajar in5 Embed
Researcher
More Details >

BuddyBoss Platform Pro <= 2.7.01 – Authentication Bypass via Apple OAuth provider

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-1909
Patch Status
Patched
Published
May 5, 2025
Affected Software
BuddyBoss Platform Pro
Researcher
More Details >

CoinPayments.net Payment Gateway for WooCommerce <= 1.0.17 – Unauthenticated PHP Object Injection

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-47532
Patch Status
Patched
Published
May 7, 2025
Affected Software
CoinPayments.net Payment Gateway for WooCommerce
Researcher
More Details >

Drag and Drop Multiple File Upload for WooCommerce <= 1.1.6 – Unauthenticated Arbitrary File Upload via upload Function

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-4403
Patch Status
Patched
Published
May 8, 2025
Affected Software
Drag and Drop Multiple File Upload for WooCommerce
Researcher
More Details >

Envolve Plugin <= 1.0 – Unauthenticated Arbitrary File Upload via language_file and fonts_file

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-11617
Patch Status
Patched
Published
May 8, 2025
Affected Software
Envolve Plugin
Researcher
More Details >

Eventin <= 4.0.26 – Missing Authorization to Unauthenticated Privilege Escalation

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-47539
Patch Status
Patched
Published
May 7, 2025
Affected Software
Event Manager, Events Calendar, Tickets, Registrations – Eventin
Researcher
More Details >

Frontend Dashboard 1.0 – 2.2.6 – Missing Authorization to Unauthenticated Privilege Escalation via fed_wp_ajax_fed_login_form_post Function

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-4104
Patch Status
Patched
Published
May 6, 2025
Affected Software
Frontend Dashboard
Researcher
More Details >

Frontend Login and Registration Blocks <= 1.0.7 – Unauthenticated Privilege Escalation via Account Takeover

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-3605
Patch Status
Unpatched
Published
May 8, 2025
Affected Software
Frontend Login and Registration Blocks
Researcher
More Details >

IMITHEMES Listing <= 3.3 – Unauthenticated Privilege Escalation via Unverified Password Reset

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-2253
Patch Status
Patched
Published
May 8, 2025
Affected Software
IMITHEMES Listing
Researcher
More Details >

PeproDev Ultimate Profile Solutions 1.9.1 – 7.5.2 – Authentication Bypass to Account Takeover

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-3844
Patch Status
Unpatched
Published
May 6, 2025
Affected Software
PeproDev Ultimate Profile Solutions
Researcher
More Details >

PGS Core <= 5.8.0 – Unauthenticated PHP Object Injection

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-0855
Patch Status
Patched
Published
May 6, 2025
Affected Software
PGS Core
Researcher
More Details >

PSW Front-end Login & Registration <= 1.12 – Authentication Bypass

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-47646
Patch Status
Unpatched
Published
May 8, 2025
Affected Software
PSW Front-end Login & Registration
Researcher
More Details >

StoreKeeper for WooCommerce <= 14.4.4 – Unauthenticated Arbitrary File Upload

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-47687
Patch Status
Unpatched
Published
May 9, 2025
Affected Software
StoreKeeper for WooCommerce
Researcher
More Details >

WP Job Portal <= 2.3.1 – Unauthenticated Local File Inclusion

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-47438
Patch Status
Patched
Published
May 8, 2025
Affected Software
WP Job Portal – A Complete Recruitment System for Company or Job Board website
Researcher
More Details >

WPBookit <= 1.0.2 – Insecure Direct Object Reference to Unauthenticated Privilege Escalation via Account Takeover

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-3810
Patch Status
Patched
Published
May 8, 2025
Affected Software
WPBookit
Researcher
More Details >

WPBookit <= 1.0.2 – Insecure Direct Object Reference to Unauthenticated Privilege Escalation via Email Update

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-3811
Patch Status
Patched
Published
May 8, 2025
Affected Software
WPBookit
Researcher
More Details >

1 Click WordPress Migration Plugin – 100% FREE for a limited time <= 2.2 – Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-3455
Patch Status
Unpatched
Published
May 8, 2025
Affected Software
1 Click WordPress Migration Plugin – 100% FREE for a limited time
Researcher
More Details >

Challan <= 3.7.58 – Cross-Site Request Forgery to Arbitrary Options Update

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-47462
Patch Status
Patched
Published
May 7, 2025
Affected Software
Challan – PDF Invoice & Packing Slip for WooCommerce
Researcher
More Details >

Display Eventbrite Events <= 6.2.6 – Authenticated (Contributor+) Local File Inclusion

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-47510
Patch Status
Patched
Published
May 7, 2025
Affected Software
Display Eventbrite Events
Researcher
More Details >

Download Monitor <= 5.0.22 – Authenticated (Contributor+) Local File Inclusion

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-47439
Patch Status
Patched
Published
May 7, 2025
Affected Software
Download Monitor
Researcher
More Details >

ELEX WordPress HelpDesk & Customer Ticketing System <= 3.2.7 – Authenticated (Subscriber+) Arbitrary File Upload

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-47658
Patch Status
Unpatched
Published
May 8, 2025
Affected Software
ELEX WordPress HelpDesk & Customer Ticketing System
Researcher
More Details >

EventON <= 2.4.1 – Authenticated (Contributor+) Local File Inclusion

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-47494
Patch Status
Patched
Published
May 7, 2025
Affected Software
EventON – Events Calendar
Researcher
More Details >

External image replace <= 1.0.8 – Authenticated (Contributor+) Arbitrary File Upload

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-4279
Patch Status
Unpatched
Published
May 5, 2025
Affected Software
External image replace
Researcher
More Details >

GamiPress <= 7.3.7 – Authenticated (Contributor+) Local File Inclusion

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-47508
Patch Status
Patched
Published
May 7, 2025
Affected Software
GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress
Researcher
More Details >

Hotel Booking <= 3.6 – Authenticated (Contributor+) Local File Inclusion

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-47498
Patch Status
Patched
Published
May 7, 2025
Affected Software
Hotel Booking
Researcher
More Details >

Lead Form Data Collection to CRM <= 3.1 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-47690
Patch Status
Unpatched
Published
May 9, 2025
Affected Software
Lead Form Data Collection to CRM
Researcher
More Details >

List category posts <= 0.90.3 – Authenticated (Contributor+) Local File Inclusion

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-47636
Patch Status
Unpatched
Published
May 7, 2025
Affected Software
List category posts
Researcher
More Details >

Open Close WooCommerce Store <= 4.9.5 – Authenticated (Contributor+) Local File Inclusion

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-47649
Patch Status
Unpatched
Published
May 7, 2025
Affected Software
Open Close WooCommerce Store – Best Business Schedules Manager
Researcher
More Details >

PublishPress Authors <= 4.7.5 – Authenticated (Contributor+) Local File Inclusion

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-47496
Patch Status
Patched
Published
May 7, 2025
Affected Software
Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors
Researcher
More Details >

Reales WP STPT <= 2.1.2 – Authenticated (Subscriber+) Privilege Escalation via Password Update

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-3610
Patch Status
Unpatched
Published
May 5, 2025
Affected Software
Reales WP STPT
Researcher
More Details >

SMS Alert Order Notifications – WooCommerce <= 3.8.1 – Authenticated (Subscriber+) Privilege Escalation via handleWpLoginCreateUserAction Function

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-3876
Patch Status
Patched
Published
May 9, 2025
Affected Software
SMS Alert Order Notifications – WooCommerce
Researcher
More Details >

Woocommerce Multiple Addresses <= 1.0.7.1 – Authenticated (Subscriber+) Privilege Escalation

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-4335
Patch Status
Unpatched
Published
May 6, 2025
Affected Software
Woocommerce Multiple Addresses
Researcher
More Details >

WordPress Review Plugin: The Ultimate Solution for Building a Review Website <= 5.3.5 – Authenticated (Contributor+) Local File Inclusion via Post Custom Fields

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-2158
Patch Status
Unpatched
Published
May 9, 2025
Affected Software
WordPress Review Plugin: The Ultimate Solution for Building a Review Website
Researcher
More Details >

WP-Recall <= 16.26.14 – Authenticated (Contributor+) Local File Inclusion

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-47653
Patch Status
Unpatched
Published
May 7, 2025
Affected Software
WP-Recall – Registration, Profile, Commerce & More
Researcher
More Details >

WPAdverts <= 2.2.2 – Authenticated (Contributor+) Local File Inclusion

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-47440
Patch Status
Patched
Published
May 7, 2025
Affected Software
WPAdverts – Classifieds Plugin
Researcher
More Details >

WPshop 2 – E-Commerce 2.0.0 – 2.6.0 – Authenticated (Subscriber+) Privilege Escalation via Account Takeover

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-3852
Patch Status
Unpatched
Published
May 6, 2025
Affected Software
WPshop 2 – E-Commerce
Researcher
More Details >

XT Event Widget for Social Events <= 1.1.7 – Authenticated (Contributor+) Local File Inclusion

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-47531
Patch Status
Patched
Published
May 7, 2025
Affected Software
XT Event Widget for Social Events
Researcher
More Details >

PeproDev Ultimate Profile Solutions 1.9.1 – 7.5.2 – Missing Authorization to Limited Unauthenticated Arbitrary User Meta Update via handel_ajax_req Function

8.2
CVSS Rating
High (8.2)
CVE-ID
CVE-2025-3921
Patch Status
Unpatched
Published
May 6, 2025
Affected Software
PeproDev Ultimate Profile Solutions
Researcher
More Details >

belingoGeo <= 1.12.0 – Unauthenticated Arbitrary File Download

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2025-47603
Patch Status
Unpatched
Published
May 9, 2025
Affected Software
belingoGeo
Researcher
More Details >

Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.26 – Unauthenticated Arbitrary File Read

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2025-3419
Patch Status
Patched
Published
May 7, 2025
Affected Software
Event Manager, Events Calendar, Tickets, Registrations – Eventin
Researcher
More Details >

Graphina <= 3.0.4 – Cross-Site Request Forgery to Local File Inclusion

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2025-47533
Patch Status
Patched
Published
May 7, 2025
Affected Software
Graphina – Elementor Charts and Graphs
Researcher
More Details >

PGS Core <= 5.8.0 – Unauthenticated SQL Injection

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2025-0853
Patch Status
Patched
Published
May 6, 2025
Affected Software
PGS Core
Researcher
More Details >

Productive Commerce <= 1.1.22 – Unauthenticated SQL Injection

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2025-47657
Patch Status
Unpatched
Published
May 7, 2025
Affected Software
Productive Commerce – WooCommerce Wishlist, Compare, Quick View, & MiniCart
Researcher
More Details >

Slider & Popup Builder by Depicter <= 3.6.1 – Unauthenticated SQL Injection via ‘s’ Parameter

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2025-2011
Patch Status
Patched
Published
May 5, 2025
Affected Software
Popup and Slider Builder by Depicter – Add Email collecting Popup, Popup Modal, Coupon Popup, Image Slider, Carousel Slider, Post Slider Carousel
Researcher
More Details >

SMS Alert Order Notifications – WooCommerce <= 3.8.2 – Unauthenticated SQL Injection

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2025-47682
Patch Status
Patched
Published
May 8, 2025
Affected Software
SMS Alert Order Notifications – WooCommerce
Researcher
More Details >

LayoutBoxx <= 0.3.1 – Unauthenticated Arbitrary Shortcode Execution

7.3
CVSS Rating
High (7.3)
CVE-ID
CVE-2025-2802
Patch Status
Unpatched
Published
May 5, 2025
Affected Software
LayoutBoxx
Researcher
More Details >

PGS Core <= 5.8.0 – Missing Authorization via Multiple Functions

7.3
CVSS Rating
High (7.3)
CVE-ID
CVE-2025-0856
Patch Status
Patched
Published
May 6, 2025
Affected Software
PGS Core
Researcher
More Details >

Wolmart | Multi-Vendor Marketplace WooCommerce Theme <= 1.8.11 – Unauthenticated Arbitrary Shortcode Execution in wolmart_loadmore

7.3
CVSS Rating
High (7.3)
CVE-ID
CVE-2024-13793
Patch Status
Patched
Published
May 7, 2025
Affected Software
Wolmart | Multi-Vendor Marketplace WooCommerce Theme
Researcher
More Details >

BEAF <= 4.6.10 – Authenticated (Admin+) Arbitrary File Upload

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2025-47549
Patch Status
Patched
Published
May 7, 2025
Affected Software
Ultimate Before After Image Slider & Gallery – BEAF
Researcher
More Details >

Instantio <= 3.3.16 – Authenticated (Admin+) Arbitrary File Upload

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2025-47550
Patch Status
Patched
Published
May 7, 2025
Affected Software
Instantio – WooCommerce Quick Checkout | Direct Checkout, Floating Cart, Side Cart & Popup Cart
Researcher
More Details >

Ultimate Member <= 2.10.3 – Authenticated (Administrator+) Arbitrary Function Call

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2025-47691
Patch Status
Unpatched
Published
May 7, 2025
Affected Software
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
Researcher
More Details >

Wbcom Designs – Activity Link Preview For BuddyPress <= 1.4.4 – Unauthenticated Server-Side Request Forgery

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2025-47548
Patch Status
Patched
Published
May 7, 2025
Affected Software
Wbcom Designs – Activity Link Preview For BuddyPress
Researcher
More Details >

WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg <= 4.1.1.2 – Authenticated (Administrator+) Arbitrary File Deletion

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2025-4206
Patch Status
Patched
Published
May 8, 2025
Affected Software
WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg
Researcher
More Details >

WP Maintenance <= 6.1.9.7 – Authenticated (Administrator+) PHP Object Injection

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2025-47683
Patch Status
Unpatched
Published
May 7, 2025
Affected Software
WP Maintenance
Researcher
More Details >

WP-CRM System <= 3.4.2 – Authenticated (Administrator+) PHP Object Injection

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2025-47629
Patch Status
Unpatched
Published
May 7, 2025
Affected Software
WordPress CRM Plugin – WP-CRM System
Researcher
More Details >

GS Testimonial Slider <= 3.2.9 – Unauthenticated Arbitrary Shortcode Execution

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2025-47481
Patch Status
Patched
Published
May 7, 2025
Affected Software
A WordPress Testimonial Plugin to Showcase Testimonial Slider, Testimonial Grid and More: Solid Testimonials
Researcher
More Details >

Ultimate WP Mail <= 1.3.4 – Authenticated (Contributor+) SQL Injection

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2025-47490
Patch Status
Patched
Published
May 7, 2025
Affected Software
Ultimate WP Mail
Researcher
More Details >

WPshop 2 – E-Commerce 2.0.0 – 2.6.0 – Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Key Generation

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2025-3853
Patch Status
Unpatched
Published
May 6, 2025
Affected Software
WPshop 2 – E-Commerce
Researcher
More Details >

aBlocks <= 1.9.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-47616
Patch Status
Unpatched
Published
May 7, 2025
Affected Software
aBlocks – WordPress Gutenberg Blocks
Researcher
More Details >

Ajax Load More <= 7.3.1.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-47630
Patch Status
Unpatched
Published
May 7, 2025
Affected Software
WordPress Infinite Scroll – Ajax Load More
Researcher
More Details >

Awesome Gallery <= 1.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-47632
Patch Status
Unpatched
Published
May 7, 2025
Affected Software
Awesome Gallery
Researcher
More Details >

Beds24 Online Booking <= 2.0.29 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-47489
Patch Status
Patched
Published
May 7, 2025
Affected Software
Beds24 Online Booking
Researcher
More Details >

Better Search <= 4.1.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-47507
Patch Status
Patched
Published
May 7, 2025
Affected Software
Better Search – Relevant search results for WordPress
Researcher
More Details >

Blockspare <= 3.2.9 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-47495
Patch Status
Patched
Published
May 7, 2025
Affected Software
BlockSpare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites – Post Grids, Sliders, Carousels, Counters, Page Builder & Starter Site Imports, No Coding Needed
Researcher
More Details >

Bold Page Builder <= 5.3.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-47488
Patch Status
Patched
Published
May 7, 2025
Affected Software
Bold Page Builder
Researcher
More Details >

CarDealerPress <= 6.8.2505.00 – Authenticated (Contributor+) Stored Cross-Site Scripting via saleclass Parameter

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-3860
Patch Status
Patched
Published
May 6, 2025
Affected Software
CarDealerPress
Researcher
More Details >

CBX Map for Google Map & OpenStreetMap <= 1.1.12 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-47669
Patch Status
Unpatched
Published
May 7, 2025
Affected Software
CBX Map for Google Map & OpenStreetMap
Researcher
More Details >

CC BMI Calculator <= 2.1.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-47442
Patch Status
Patched
Published
May 7, 2025
Affected Software
CC BMI Calculator
Researcher
More Details >

Cision Block <= 4.3.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-3782
Patch Status
Patched
Published
May 5, 2025
Affected Software
Cision Block
Researcher
More Details >

Content Control <= 2.6.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-47501
Patch Status
Patched
Published
May 7, 2025
Affected Software
Content Control – The Ultimate Content Restriction Plugin! Restrict Content, Create Conditional Blocks & More
Researcher
More Details >

Contest Gallery <= 26.0.6 – Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-3862
Patch Status
Patched
Published
May 7, 2025
Affected Software
Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons
Researcher
More Details >

Contextual Related Posts <= 4.0.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-47506
Patch Status
Patched
Published
May 7, 2025
Affected Software
Contextual Related Posts
Researcher
More Details >

Cost Calculator for Elementor <= 1.3.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-47476
Patch Status
Patched
Published
May 7, 2025
Affected Software
Cost Calculator for Elementor
Researcher
More Details >

Custom Checkout Fields for WooCommerce <= 1.8.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-47504
Patch Status
Patched
Published
May 7, 2025
Affected Software
Custom Checkout Fields for WooCommerce
Researcher
More Details >

DELUCKS SEO <= 2.5.9 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-47686
Patch Status
Unpatched
Published
May 7, 2025
Affected Software
DELUCKS SEO
Researcher
More Details >

Display Remote Posts Block <= 1.1.0 – Authenticated (Contributor+) Server-Side Request Forgery

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-47484
Patch Status
Patched
Published
May 7, 2025
Affected Software
Display Remote Posts Block
Researcher
More Details >

Easy Replace Image <= 3.5.0 – Authenticated (Contributor+) Server-Side Request Forgery

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-47483
Patch Status
Patched
Published
May 7, 2025
Affected Software
Easy Replace Image
Researcher
More Details >

Ebook Store <= 5.8007 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-47589
Patch Status
Unpatched
Published
May 7, 2025
Affected Software
Ebook Store
Researcher
More Details >

Inline Related Posts <= 3.8.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-47604
Patch Status
Unpatched
Published
May 7, 2025
Affected Software
Inline Related Posts
Researcher
More Details >

Jeg Elementor Kit <= 2.6.12 – Authenticated (Contributor+) Stored Cross-Site Scripting via Video Button and Countdown Widgets

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-2944
Patch Status
Patched
Published
May 9, 2025
Affected Software
Jeg Elementor Kit
Researcher
More Details >

JupiterX Core <= 4.8.11 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-47475
Patch Status
Patched
Published
May 7, 2025
Affected Software
Jupiter X Core
Researcher
More Details >

Logo Showcase <= 3.0.4 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-47497
Patch Status
Patched
Published
May 7, 2025
Affected Software
Logo Showcase
Researcher
More Details >

Meks Flexible Shortcodes <= 1.3.6 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-47621
Patch Status
Patched
Published
May 7, 2025
Affected Software
Meks Flexible Shortcodes
Researcher
More Details >

Meow Gallery <= 5.2.7 – Authenticated (Author+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-47449
Patch Status
Patched
Published
May 7, 2025
Affected Software
Meow Gallery
Researcher
More Details >

Mollie Forms <= 2.7.12 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-47502
Patch Status
Patched
Published
May 7, 2025
Affected Software
Mollie Forms
Researcher
More Details >

Multiple Post Type Order <= 1.10.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via mpto Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-4055
Patch Status
Unpatched
Published
May 6, 2025
Affected Software
Multiple Post Type Order
Researcher
More Details >

NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.9.1 – Authenticated (Custom) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-3468
Patch Status
Patched
Published
May 7, 2025
Affected Software
NEX-Forms – Ultimate Forms Plugin for WordPress
Researcher
More Details >

NGG Smart Image Search <= 3.3.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-47503
Patch Status
Patched
Published
May 7, 2025
Affected Software
NGG Smart Image Search
Researcher
More Details >

Photo Gallery – GT3 Image Gallery & Gutenberg Block Gallery <= 2.7.7.25 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-47677
Patch Status
Unpatched
Published
May 7, 2025
Affected Software
Photo Gallery – GT3 Image Gallery & Gutenberg Block Gallery
Researcher
More Details >

Product Time Countdown for WooCommerce <= 1.6.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-47505
Patch Status
Patched
Published
May 7, 2025
Affected Software
Product Time Countdown for WooCommerce
Researcher
More Details >

Progress Bar <= 2.2.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-47441
Patch Status
Patched
Published
May 7, 2025
Affected Software
Progress Bar
Researcher
More Details >

Royal Elementor Addons <= 1.7.1017 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-39361
Patch Status
Patched
Published
May 7, 2025
Affected Software
Royal Elementor Addons and Templates
Researcher
More Details >

RS WP Book Showcase <= 6.7.40 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-47679
Patch Status
Unpatched
Published
May 7, 2025
Affected Software
RS WP Book Showcase – A Complete Book Catalogue & Library System
Researcher
More Details >

SendPulse Email Marketing Newsletter <= 2.1.6 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-47547
Patch Status
Patched
Published
May 7, 2025
Affected Software
SendPulse Email Marketing Newsletter
Researcher
More Details >

Simple Blog Stats <= 20250416 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-47499
Patch Status
Patched
Published
May 7, 2025
Affected Software
Simple Blog Stats
Researcher
More Details >

SKT Skill Bar <= 2.4 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-47482
Patch Status
Patched
Published
May 7, 2025
Affected Software
SKT Skill Bar
Researcher
More Details >

SMS Alert Order Notifications – WooCommerce <= 3.8.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via sa_verify Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-3878
Patch Status
Patched
Published
May 9, 2025
Affected Software
SMS Alert Order Notifications – WooCommerce
Researcher
More Details >

Solace Extra <= 1.3.1 – Authenticated (Subscriber+) Server-Side Request Forgery

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-47464
Patch Status
Patched
Published
May 7, 2025
Affected Software
Solace Extra
Researcher
More Details >

Spiraclethemes Site Library <= 1.4.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-47656
Patch Status
Unpatched
Published
May 7, 2025
Affected Software
Spiraclethemes Site Library
Researcher
More Details >

Top 10 <= 4.1.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-47509
Patch Status
Patched
Published
May 7, 2025
Affected Software
Top 10 – WordPress Popular posts by WebberZone
Researcher
More Details >

Ultimate Blocks <= 3.2.9 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-47493
Patch Status
Patched
Published
May 7, 2025
Affected Software
Ultimate Blocks – WordPress Blocks Plugin
Researcher
More Details >

User Login History <= 2.1.6 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-47676
Patch Status
Unpatched
Published
May 7, 2025
Affected Software
User Login History
Researcher
More Details >

Widget Countdown <= 2.7.4 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-47443
Patch Status
Patched
Published
May 7, 2025
Affected Software
Countdown Timer – Widget Countdown
Researcher
More Details >

Woobox <= 1.6 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-47662
Patch Status
Unpatched
Published
May 7, 2025
Affected Software
Woobox
Researcher
More Details >

Woobox <= 1.6 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-47675
Patch Status
Unpatched
Published
May 7, 2025
Affected Software
Woobox
Researcher
More Details >

WP DPE-GES <= 1.6 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-47515
Patch Status
Patched
Published
May 7, 2025
Affected Software
WP DPE-GES
Researcher
More Details >

WP SEO Structured Data Schema <= 2.7.11 – Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin Settings

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-4127
Patch Status
Patched
Published
May 7, 2025
Affected Software
WP SEO Structured Data Schema
Researcher
More Details >

WPBakery Visual Composer WHMCS Elements <= 1.0.4.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-47659
Patch Status
Unpatched
Published
May 7, 2025
Affected Software
WPBakery Visual Composer WHMCS Elements
Researcher
More Details >

WZ Followed Posts – Display what visitors are reading <= 3.1.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-4171
Patch Status
Patched
Published
May 6, 2025
Affected Software
WZ Followed Posts – Display what visitors are reading
Researcher
More Details >

Xavin’s List Subpages <= 1.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-4220
Patch Status
Unpatched
Published
May 6, 2025
Affected Software
Xavin’s List Subpages
Researcher
More Details >

NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.9.1 – Authenticated (Custom) Limited Code Execution via get_table_records Function

6.3
CVSS Rating
Medium (6.3)
CVE-ID
CVE-2025-4208
Patch Status
Patched
Published
May 7, 2025
Affected Software
NEX-Forms – Ultimate Forms Plugin for WordPress
Researcher
More Details >

Accept Donations with PayPal <= 1.4.5 – Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-47517
Patch Status
Patched
Published
May 7, 2025
Affected Software
Accept Donations with PayPal & Stripe
Researcher
More Details >

BMI Adult & Kid Calculator <= 1.2.2 – Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-47618
Patch Status
Unpatched
Published
May 8, 2025
Affected Software
BMI Adult & Kid Calculator
Researcher
More Details >

Contribuinte Checkout <= 2.0.02 – Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-47685
Patch Status
Unpatched
Published
May 7, 2025
Affected Software
Contribuinte Checkout
Researcher
More Details >

ELI’s Related Posts Footer Links and Widget <= 1.2.04.20 – Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-47514
Patch Status
Patched
Published
May 7, 2025
Affected Software
EZ Related Posts Footer Links and Widget
Researcher
More Details >

FunnelCockpit <= 1.4.2 – Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-47678
Patch Status
Unpatched
Published
May 9, 2025
Affected Software
FunnelCockpit
Researcher
More Details >

Integration for WooCommerce and Salesforce <= 1.7.5 – Open Redirect

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-47455
Patch Status
Patched
Published
May 7, 2025
Affected Software
Integration for WooCommerce and Salesforce
Researcher
More Details >

Integrations of Zoho CRM with Elementor form <= 1.0.7 – Open Redirect

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-47644
Patch Status
Unpatched
Published
May 7, 2025
Affected Software
Integrations of Zoho CRM with Elementor form
Researcher
More Details >

Relevanssi <= 4.24.3 (Free) and <= 2.27.4 (Premium) – Unauthenticated Stored Cross-Site Scripting via Search Highlights

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-4054
Patch Status
Patched
Published
May 6, 2025
Affected Software
Relevanssi – A Better Search
Relevanssi – A Better Search (Pro)
Researcher
More Details >

tagDiv Composer <= 5.3 – Reflected Cross-Site Scripting via ‘data’

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-2806
Patch Status
Patched
Published
May 7, 2025
Affected Software
tagDiv Composer
Researcher
More Details >

theMarketer <= 1.4.7 – Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-47655
Patch Status
Unpatched
Published
May 7, 2025
Affected Software
theMarketer – Email marketing, Newsletters, Automation & Loyalty for Woocommerce
Researcher
More Details >

WP Gravity Forms Dynamics CRM <= 1.1.4 – Open Redirect

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-47454
Patch Status
Patched
Published
May 7, 2025
Affected Software
WP Gravity Forms Dynamics CRM
Researcher
More Details >

WP Gravity Forms Zendesk <= 1.1.2 – Open Redirect

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-47456
Patch Status
Patched
Published
May 7, 2025
Affected Software
WP Gravity Forms Zendesk
Researcher
More Details >

xili-tidy-tags <= 1.12.06 – Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-47680
Patch Status
Unpatched
Published
May 8, 2025
Affected Software
xili-tidy-tags
Researcher
More Details >

EUCookieLaw <= 2.7.2 – Unauthenticated Arbitrary File Read

5.9
CVSS Rating
Medium (5.9)
CVE-ID
CVE-2025-3897
Patch Status
Patched
Published
May 8, 2025
Affected Software
EUCookieLaw
Researcher
More Details >

DoFollow Case by Case <= 3.5.1 – Authenticated (Administrator+) Stored Cross-Site Scripting

5.5
CVSS Rating
Medium (5.5)
CVE-ID
CVE-2025-47625
Patch Status
Unpatched
Published
May 7, 2025
Affected Software
DoFollow Case by Case
Researcher
More Details >

LiteSpeed Cache <= 7.0.1 – Authenticated (Editor+) Server-Side Request Forgery

5.5
CVSS Rating
Medium (5.5)
CVE-ID
CVE-2025-47437
Patch Status
Patched
Published
May 7, 2025
Affected Software
LiteSpeed Cache
Researcher
More Details >

Really Simple Under Construction Page <= 1.4.6 – Authenticated (Administrator+) Stored Cross-Site Scripting

5.5
CVSS Rating
Medium (5.5)
CVE-ID
CVE-2025-47593
Patch Status
Unpatched
Published
May 7, 2025
Affected Software
Really Simple Under Construction Page
Researcher
More Details >

WebinarPress <= 1.33.27 – Authenticated (Administrator+) Server-Side Request Forgery

5.5
CVSS Rating
Medium (5.5)
CVE-ID
CVE-2025-47635
Patch Status
Unpatched
Published
May 7, 2025
Affected Software
WordPress Webinar Plugin – WebinarPress
Researcher
More Details >

WP Pipes <= 1.4.3 – Authenticated (Administrator+) Server-Side Request Forgery

5.5
CVSS Rating
Medium (5.5)
CVE-ID
CVE-2025-47664
Patch Status
Unpatched
Published
May 7, 2025
Affected Software
WP Pipes
Researcher
More Details >

Login Lockdown & Protection <= 2.11 – Missing Authorization to Authenticated (Subscriber+) Arbitrary IP Whitelisting

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2025-3766
Patch Status
Patched
Published
May 6, 2025
Affected Software
Login Lockdown & Protection
Researcher
More Details >

Media Hygiene <= 4.0.0 – Missing Authorization

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2025-47469
Patch Status
Patched
Published
May 7, 2025
Affected Software
Media Hygiene: Remove or Delete Unused Images and More!
Researcher
More Details >

Royal Elementor Addons and Templates <= 1.7.1017 – Authenticated (Contributor+) Stored Cross-Site Scripting

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-12120
Patch Status
Patched
Published
May 6, 2025
Affected Software
Royal Elementor Addons and Templates
Researcher
More Details >

Supertext Translation and Proofreading <= 4.25 – Cross-Site Request Forgery to Stored Cross-Site Scripting

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2025-47639
Patch Status
Unpatched
Published
May 7, 2025
Affected Software
Supertext Translation and Proofreading
Researcher
More Details >

Uncanny Automator <= 6.4.0.2 – Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2025-4520
Patch Status
Patched
Published
May 9, 2025
Affected Software
Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin
Researcher
More Details >

WPForms Lite <= 1.9.5 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘start_timestamp’ Parameter

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2025-3794
Patch Status
Patched
Published
May 9, 2025
Affected Software
WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More
Researcher
More Details >

Advanced File Manager <= 5.3.1 – Missing Authorization to Notice Dismisaal

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-47688
Patch Status
Patched
Published
May 7, 2025
Affected Software
Advanced File Manager — Ultimate WordPress File Manager and Document Library Plugin
Researcher
More Details >

Cozy Blocks <= 2.1.22 – Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-47485
Patch Status
Patched
Published
May 7, 2025
Affected Software
Cozy Blocks – Page Builder for Gutenberg & Site Editor with Post Blocks, WooCommerce Blocks, Magazine Blocks & WordPress Gutenberg Blocks
Researcher
More Details >

Envolve Plugin <= 1.0 – Unauthenticated Language File Deletion

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-11615
Patch Status
Patched
Published
May 5, 2025
Affected Software
Envolve Plugin
Researcher
More Details >

Gutenberg & Elementor Templates Importer For Responsive <= 3.1.9 – Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-47486
Patch Status
Patched
Published
May 7, 2025
Affected Software
Responsive Plus – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme.
Researcher
More Details >

LocateAndFilter <= 1.6.16 – Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-47457
Patch Status
Patched
Published
May 7, 2025
Affected Software
LocateAndFilter
Researcher
More Details >

Mail Mint <= 1.17.7 – Unauthenticated Sensitive Information Exposure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-47541
Patch Status
Patched
Published
May 7, 2025
Affected Software
Email Marketing, Email Automation, Newsletter & Cart Abandonment for WordPress and WooCommerce – Mail Mint
Researcher
More Details >

PeproDev Ultimate Profile Solutions 1.9.1 – 7.5.2 – Missing Authorization to Unauthenticated Email Enumeration

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-3924
Patch Status
Unpatched
Published
May 6, 2025
Affected Software
PeproDev Ultimate Profile Solutions
Researcher
More Details >

Poll Maker <= 5.7.7 – Unauthenticated Race Condition to Multi-Vote

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-47545
Patch Status
Patched
Published
May 7, 2025
Affected Software
Poll Maker – Versus Polls, Anonymous Polls, Image Polls
Researcher
More Details >

Reales WP STPT <= 2.1.2 – Unauthorized User Registration

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-3609
Patch Status
Unpatched
Published
May 5, 2025
Affected Software
Reales WP STPT
Researcher
More Details >

Search Exclude <= 2.4.9 – Missing Authorization to Unauthenticated Plugin Settings Modification

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-2821
Patch Status
Patched
Published
May 6, 2025
Affected Software
Search Exclude
Researcher
More Details >

Simple File List <= 6.1.13 – Missing Authorization to Unauthenticated Minor Settings Update

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-47450
Patch Status
Patched
Published
May 7, 2025
Affected Software
Simple File List
Researcher
More Details >

User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.2.1 – Insecure Direct Object Reference to Unauthenticated Limited User Deletion

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-3281
Patch Status
Patched
Published
May 5, 2025
Affected Software
User Registration & Membership – Custom Registration Form, Login Form, and User Profile
Researcher
More Details >

weMail <= 1.14.13 – Unauthenticated Sensitive Information Exposure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-47540
Patch Status
Patched
Published
May 7, 2025
Affected Software
weMail – Email Marketing, Lead Generation, Optin Forms, Email Newsletters, A/B Testing, and Automation
Researcher
More Details >

Cart tracking for WooCommerce <= 1.0.17 – Authenticated (Administrator+) SQL Injection

4.9
CVSS Rating
Medium (4.9)
CVE-ID
CVE-2025-47538
Patch Status
Patched
Published
May 7, 2025
Affected Software
Cart tracking for WooCommerce
Researcher
More Details >

Dynamic Pricing With Discount Rules for WooCommerce <= 4.5.8 – Authenticated (Shop manager+) SQL Injection

4.9
CVSS Rating
Medium (4.9)
CVE-ID
CVE-2025-47544
Patch Status
Patched
Published
May 7, 2025
Affected Software
Dynamic Pricing With Discount Rules for WooCommerce
Researcher
More Details >

ELEX Product Feed for WooCommerce <= 3.1.2 – Authenticated (Administrator+) SQL Injection

4.9
CVSS Rating
Medium (4.9)
CVE-ID
CVE-2025-47643
Patch Status
Unpatched
Published
May 7, 2025
Affected Software
ELEX Product Feed for WooCommerce
Researcher
More Details >

PDF Invoices for WooCommerce + Drag and Drop Template Builder <= 5.3.8 – Authenticated (Administrator+) SQL Injection

4.9
CVSS Rating
Medium (4.9)
CVE-ID
CVE-2025-47537
Patch Status
Patched
Published
May 7, 2025
Affected Software
PDF for WooCommerce – ALL in One + Drag And Drop Template Builder
Researcher
More Details >

TrackShip for WooCommerce <= 1.9.1 – Authenticated (Shop manager+) SQL Injection

4.9
CVSS Rating
Medium (4.9)
CVE-ID
CVE-2025-47460
Patch Status
Patched
Published
May 7, 2025
Affected Software
TrackShip for WooCommerce
Researcher
More Details >

YaySMTP <= 2.6.4 – Authenticated (Administrator+) SQL Injection

4.9
CVSS Rating
Medium (4.9)
CVE-ID
CVE-2025-47587
Patch Status
Patched
Published
May 7, 2025
Affected Software
YaySMTP and Email Logs: Amazon SES, SendGrid, Outlook, Mailgun, Brevo, Google and Any SMTP Service
Researcher
More Details >

Amazon Product in a Post <= 5.2.2 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2025-47615
Patch Status
Unpatched
Published
May 7, 2025
Affected Software
Amazon Product in a Post Plugin
Researcher
More Details >

AWEOS WP Lock <= 1.4.8 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2025-47522
Patch Status
Patched
Published
May 7, 2025
Affected Software
AWEOS WP Lock
Researcher
More Details >

Bold Page Builder <= 5.3.0 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2025-47525
Patch Status
Patched
Published
May 7, 2025
Affected Software
Bold Page Builder
Researcher
More Details >

Charitable <= 1.8.5.1 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2025-47520
Patch Status
Patched
Published
May 7, 2025
Affected Software
Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More
Researcher
More Details >

Color Your Bar <= 2.0 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2025-47595
Patch Status
Unpatched
Published
May 7, 2025
Affected Software
Color Your Bar
Researcher
More Details >

Contact Form 7 – PayPal & Stripe Add-on <= 2.3.4 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2025-47518
Patch Status
Patched
Published
May 7, 2025
Affected Software
Contact Form 7 – PayPal & Stripe Add-on
Researcher
More Details >

CookieCode <= 2.4.4 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2025-47668
Patch Status
Unpatched
Published
May 7, 2025
Affected Software
CookieCode
Researcher
More Details >

Easy PayPal Buy Now Button <= 2.0 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2025-47623
Patch Status
Unpatched
Published
May 7, 2025
Affected Software
Easy PayPal & Stripe Buy Now Button
Researcher
More Details >

Email Notification on Login <= 1.6.1 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2025-47622
Patch Status
Unpatched
Published
May 7, 2025
Affected Software
Email Notification on Login
Researcher
More Details >

Legal Terms and Conditions Popup for User Login and WooCommerce Checkout – TPUL <= 2.0.3 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2025-47592
Patch Status
Unpatched
Published
May 7, 2025
Affected Software
Legal Terms and Conditions Popup for User Login and WooCommerce Checkout – TPUL
Researcher
More Details >

N360 | Splash Screen <= 1.0.6 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2025-47665
Patch Status
Unpatched
Published
May 7, 2025
Affected Software
N360 | Splash Screen
Researcher
More Details >

Quran multilanguage Text & Audio <= 2.3.23 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2025-47524
Patch Status
Patched
Published
May 7, 2025
Affected Software
Quran multilanguage Text & Audio
Researcher
More Details >

Robo Gallery <= 5.0.2 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2025-47521
Patch Status
Patched
Published
May 7, 2025
Affected Software
Photo Gallery, Images, Slider in Rbs Image Gallery
Researcher
More Details >

Show All Comments <= 7.0.1 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2025-47607
Patch Status
Unpatched
Published
May 7, 2025
Affected Software
Show All Comments
Researcher
More Details >

Submission DOM tracking for Contact Form 7 <= 2.0 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2025-47626
Patch Status
Unpatched
Published
May 7, 2025
Affected Software
Submission DOM tracking for Contact Form 7
Researcher
More Details >

Time Clock <= 1.2.3 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2025-47516
Patch Status
Patched
Published
May 7, 2025
Affected Software
Time Clock – A WordPress Employee & Volunteer Time Clock Plugin
Researcher
More Details >

WP Discord Invite <= 2.5.3 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2025-47638
Patch Status
Unpatched
Published
May 7, 2025
Affected Software
WP Discord Invite
Researcher
More Details >

WP Front User Submit / Front Editor <= 4.9.3 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2025-47617
Patch Status
Unpatched
Published
May 7, 2025
Affected Software
Guest posting / Frontend Posting / Front Editor – WP Front User Submit
Researcher
More Details >

WP jQuery DataTable <= 4.1.0 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2025-47605
Patch Status
Unpatched
Published
May 7, 2025
Affected Software
WP jQuery DataTable
Researcher
More Details >

AHAthat Plugin <= 1.6 – Cross-Site Request Forgery to AHA Page Deletion

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-4337
Patch Status
Unpatched
Published
May 5, 2025
Affected Software
AHAthat Plugin
Researcher
More Details >

Awin – Advertiser Tracking for WooCommerce <= 2.0.0 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-47633
Patch Status
Unpatched
Published
May 7, 2025
Affected Software
Awin – Advertiser Tracking for WooCommerce
Researcher
More Details >

Beacon Lead Magnets and Lead Capture <= 1.5.8 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-47596
Patch Status
Unpatched
Published
May 7, 2025
Affected Software
Beacon Lead Magnets and Lead Capture
Researcher
More Details >

Bulk Featured Image <= 1.2.1 – Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-47591
Patch Status
Unpatched
Published
May 7, 2025
Affected Software
Bulk Featured Image
Researcher
More Details >

Calculate Prices based on Distance For WooCommerce <= 1.3.5 – Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-47602
Patch Status
Unpatched
Published
May 7, 2025
Affected Software
Calculate Prices based on Distance For WooCommerce
Researcher
More Details >

ClickWhale <= 2.4.6 – Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-47612
Patch Status
Unpatched
Published
May 7, 2025
Affected Software
ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages
Researcher
More Details >

Contact Form Widget <= 1.4.6 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-47491
Patch Status
Patched
Published
May 7, 2025
Affected Software
Contact Form Widget – Contact Query, Contact Page, Form Maker, Query Table
Researcher
More Details >

ContentStudio <= 1.3.3 – Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-47692
Patch Status
Unpatched
Published
May 7, 2025
Affected Software
ContentStudio
Researcher
More Details >

Cool Author Box <= 3.0.0 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-47447
Patch Status
Patched
Published
May 7, 2025
Affected Software
Cool Author Box – For Widget and Post Content
Researcher
More Details >

Credova_Financial <= 2.5.0 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-47674
Patch Status
Unpatched
Published
May 7, 2025
Affected Software
Credova Financial
Researcher
More Details >

DoFollow Case by Case <= 3.5.1 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-47624
Patch Status
Unpatched
Published
May 7, 2025
Affected Software
DoFollow Case by Case
Researcher
More Details >

Download Manager and Payment Form WordPress Plugin – WP SmartPay 1.1.0 – 2.7.13 – Authenticated (Subscriber+) Information Exposure

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-3851
Patch Status
Unpatched
Published
May 6, 2025
Affected Software
Download Manager and Payment Form WordPress Plugin – WP SmartPay
Researcher
More Details >

Easy PayPal Events <= 1.2.2 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-47519
Patch Status
Patched
Published
May 7, 2025
Affected Software
Easy PayPal Events & Tickets
Researcher
More Details >

EasyMe Connect <= 3.0.3 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-47609
Patch Status
Unpatched
Published
May 7, 2025
Affected Software
EasyMe Connect
Researcher
More Details >

Envo Extra <= 1.9.9 – Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-47471
Patch Status
Patched
Published
May 7, 2025
Affected Software
Envo Extra
Researcher
More Details >

GPT3 AI Content Writer <= 1.9.14 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-47470
Patch Status
Patched
Published
May 7, 2025
Affected Software
AI Power: Complete AI Pack
Researcher
More Details >

Graphina <= 3.0.4 – Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-47480
Patch Status
Patched
Published
May 7, 2025
Affected Software
Graphina – Elementor Charts and Graphs
Researcher
More Details >

GS Testimonial Slider <= 3.3.0 – Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-47467
Patch Status
Patched
Published
May 7, 2025
Affected Software
A WordPress Testimonial Plugin to Showcase Testimonial Slider, Testimonial Grid and More: Solid Testimonials
Researcher
More Details >

GS Variation Swatches for WooCommerce <= 3.0.4 – Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-47526
Patch Status
Patched
Published
May 7, 2025
Affected Software
GS Variation Swatches for WooCommerce
Researcher
More Details >

Hash Form <= 1.2.8 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-47468
Patch Status
Patched
Published
May 7, 2025
Affected Software
Hash Form – Drag & Drop Form Builder
Researcher
More Details >

LessButtons Social Sharing and Statistics <= 1.6.1 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-47614
Patch Status
Unpatched
Published
May 7, 2025
Affected Software
LessButtons Social Sharing and Statistics
Researcher
More Details >

Listamester <= 2.3.6 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-47446
Patch Status
Patched
Published
May 7, 2025
Affected Software
Listamester
Researcher
More Details >

LiveAgent <= 4.4.7 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-47667
Patch Status
Unpatched
Published
May 7, 2025
Affected Software
LiveAgent – Omnichannel Help Desk & Live Chat Software
Researcher
More Details >

Martins Free Monetized Ad Exchange Network <= 1.0.5 – Cross-Site Request Forgery to Stored Cross-Site Scripting

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-47620
Patch Status
Unpatched
Published
May 7, 2025
Affected Software
Martins Free Monetized Ad Exchange Network – Get more website visitors
Researcher
More Details >

Music Player for WooCommerce <= 1.5.1 – Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-47472
Patch Status
Patched
Published
May 7, 2025
Affected Software
Music Player for WooCommerce
Researcher
More Details >

Ovation Elements <= 1.1.2 – Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-47528
Patch Status
Patched
Published
May 7, 2025
Affected Software
Ovation Elements
Researcher
More Details >

Pays – WooCommerce Payment Gateway <= 2.6 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-47648
Patch Status
Unpatched
Published
May 7, 2025
Affected Software
Pays – WooCommerce Payment Gateway
Researcher
More Details >

Product Quantity Dropdown For Woocommerce <= 1.2 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-47451
Patch Status
Patched
Published
May 7, 2025
Affected Software
Product Quantity Dropdown For Woocommerce
Researcher
More Details >

PW WooCommerce Bulk Edit <= 2.134 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-47473
Patch Status
Patched
Published
May 7, 2025
Affected Software
PW WooCommerce Bulk Edit
Researcher
More Details >

QS Dark Mode <= 3.0 – Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-47628
Patch Status
Unpatched
Published
May 7, 2025
Affected Software
QS Dark Mode Plugin
Researcher
More Details >

Seznam Webmaster <= 1.4.7 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-47523
Patch Status
Patched
Published
May 7, 2025
Affected Software
Seznam Webmaster
Researcher
More Details >

Sidebar Manager Light <= 1.18 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-47647
Patch Status
Unpatched
Published
May 7, 2025
Affected Software
Sidebar Manager Light
Researcher
More Details >

Simple calendar for Elementor <= 1.6.5 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-47542
Patch Status
Patched
Published
May 7, 2025
Affected Software
Simple calendar for Elementor
Researcher
More Details >

Simple Giveaways <= 2.48.2 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-47606
Patch Status
Unpatched
Published
May 7, 2025
Affected Software
Simple Giveaways – Grow your business, email lists and traffic with contests
Researcher
More Details >

Smaily for WP <= 3.1.6 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-47684
Patch Status
Unpatched
Published
May 7, 2025
Affected Software
Smaily for WP
Researcher
More Details >

Soccer Live Scores <= 1.0.5 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-47594
Patch Status
Unpatched
Published
May 7, 2025
Affected Software
Soccer Live Scores
Researcher
More Details >

TrueBooker <= 1.0.7 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-47543
Patch Status
Patched
Published
May 7, 2025
Affected Software
TrueBooker – Appointment Booking and Scheduler Plugin.
Researcher
More Details >

Ultimate WP Mail <= 1.3.4 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-47466
Patch Status
Patched
Published
May 7, 2025
Affected Software
Ultimate WP Mail
Researcher
More Details >

Web Accessibility with Max Access <= 2.0.9 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-47681
Patch Status
Unpatched
Published
May 7, 2025
Affected Software
Web Accessibility with Max Access
Researcher
More Details >

Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode <= 6.18.15 – Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-3949
Patch Status
Patched
Published
May 8, 2025
Affected Software
Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode
Researcher
More Details >

Wiki Embed <= 1.4.6 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-47551
Patch Status
Patched
Published
May 7, 2025
Affected Software
Wiki Embed
Researcher
More Details >

WP Compress <= 6.30.30 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-47546
Patch Status
Patched
Published
May 7, 2025
Affected Software
WP Compress – Instant Performance & Speed Optimization
Researchers
More Details >

WP Fundraising Donation and Crowdfunding Platform <= 1.7.3 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-47459
Patch Status
Patched
Published
May 7, 2025
Affected Software
FundEngine – Donation and Crowdfunding Platform
Researcher
More Details >

WP Hotel Booking <= 2.1.9 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-47448
Patch Status
Patched
Published
May 7, 2025
Affected Software
WP Hotel Booking
Researcher
More Details >

WP Podcasts Manager <= 1.2 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-47597
Patch Status
Unpatched
Published
May 7, 2025
Affected Software
WP Podcasts Manager
Researcher
More Details >

WPSpeed <= 2.6.5 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-47590
Patch Status
Unpatched
Published
May 7, 2025
Affected Software
WPSpeed
Researcher
More Details >

워드프레스 결제 심플페이 <= 5.2.11 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-47661
Patch Status
Unpatched
Published
May 7, 2025
Affected Software
워드프레스 결제 심플페이 – 우커머스 결제 플러그인
Researcher
More Details >

Blocksy <= 2.0.97 – Missing Authorization

2.7
CVSS Rating
Low (2.7)
CVE-ID
CVE-2025-47465
Patch Status
Patched
Published
May 7, 2025
Affected Software
Blocksy
Researcher
More Details >

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

The post Wordfence Intelligence Weekly WordPress Vulnerability Report (May 5, 2025 to May 11, 2025) appeared first on Wordfence.

Leave a Comment