Wordfence Intelligence Weekly WordPress Vulnerability Report (July 7, 2025 to July 13, 2025)

by

📢 Calling all Vulnerability Researchers and Bug Bounty Hunters! 📢

🌞 Spring into Summer with Wordfence! Now through August 4, 2025, earn 2X bounty rewards for all in-scope submissions from our ‘High Threat’ list in software with fewer than 5 million active installs. Bounties up to $31,200 per vulnerability. Submit bold. Earn big!

Last week, there were 87 vulnerabilities disclosed in 61 WordPress Plugins and 13 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 40 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back.

Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 27,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

Total Unpatched & Patched Vulnerabilities Last Week

Patch Status Number of Vulnerabilities
Patched 48
Unpatched 39

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating Number of Vulnerabilities
Medium Severity 54
High Severity 25
Critical Severity 8

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE Number of Vulnerabilities
Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) 28
Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) 15
Missing Authorization 12
Deserialization of Untrusted Data 8
Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) 4
Unrestricted Upload of File with Dangerous Type 4
Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’) 3
Exposure of Sensitive Information to an Unauthorized Actor 2
Improper Control of Generation of Code (‘Code Injection’) 2
Improper Privilege Management 2
Authentication Bypass Using an Alternate Path or Channel 1
Authorization Bypass Through User-Controlled Key 1
External Control of File Name or Path 1
Improper Neutralization of Formula Elements in a CSV File 1
Server-Side Request Forgery (SSRF) 1
Unverified Password Change 1
Use of Hard-coded Credentials 1

Researchers That Contributed to WordPress Security Last Week

Researcher Name Number of Vulnerabilities
9
7
6
5
5
5
4
4
2
2
2
2
2
2
2
2
2
2
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name Software Slug
AI Engine ai-engine
Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer) azon-addon-js-composer
BeeTeam368 Extensions beeteam368-extensions
Broken Link Notifier broken-link-notifier
Contact Form 7 Editor Button cf7-editor-button
CoSchool LMS – A complete Learning Management System to Create and Sell Your Courses Online coschool
CSS3 Compare Pricing Tables for WordPress css3_web_pricing_tables_grids
Dot html,php,xml etc pages dot-htmlphpxml-etc-pages
Essential Addons for Elementor – Popular Elementor Templates & Widgets essential-addons-for-elementor-lite
Events Manager – Calendar, Bookings, Tickets, and more! events-manager
FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel foogallery
Friends friends
FunnelKit – Funnel Builder for WooCommerce Checkout funnel-builder
GB Forms DB gb-forms-db
Guest Support – Complete customer support ticket system for WordPress guest-support
Gutenberg Blocks with AI by Kadence WP – Page Builder Features kadence-blocks
Gwolle Guestbook gwolle-gb
HTML5 Radio Player – WPBakery Page Builder Addon lbg-cleverbakery
Infility Global infility-global
Internal Linking of Related Contents internal-linking-of-related-contents
Lana Downloads Manager lana-downloads-manager
Lightbox & Modal Popup WordPress Plugin – FooBox foobox-image-lightbox
LoginWP – Pro loginwp-pro
Media Folder media-folder
Modern Events Calendar Lite modern-events-calendar-lite
Multi-language Responsive Contact Form responsive-contact-form
Pakke Envíos pakke
Pay with Contact Form 7 pay-with-contact-form-7
Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons, OpenAI contest-gallery
Premium Age Verification / Restriction for WordPress age-restriction
Premium SEO Pack – WP SEO Plugin premium-seo-pack
Pro Bulk Watermark Plugin for WordPress pro-watermark
Product XML Feed Manager for WooCommerce – Google Shopping, Social Sites, Skroutz & More product-xml-feeds-for-woocommerce
ProfileGrid – User Profiles, Groups and Communities profilegrid-user-profiles-groups-and-communities
Profiler – What Slowing Down Your WP profiler-what-slowing-down
PW WooCommerce On Sale! pw-woocommerce-on-sale
RSFirewall! rsfirewall
Simple Featured Image simple-featured-image
Site Chat on Telegram site-chat-on-telegram
SmartSEO | SEO & Marketing Services WordPress Theme smartseo
SMu Manual DoFollow manuall-dofollow
Super Store Finder superstorefinder-wp
Support Board supportboard
SureForms – Drag and Drop Form Builder for WordPress sureforms
Tennis Court Bookings tennis-court-bookings
The E-Commerce ERP: Purchasing, Inventory, Fulfillment, Manufacturing, BOM, Accounting, Sales Analysis profitori
Torod – The smart shipping and delivery portal for e-shops and retailers torod
Ultimate Push Notifications ( Mobile / Desktop ), Receive Notification From WooCommerce, BuddyPress, WordPress Default Events & Many More ultimate-push-notifications
URL Shortener Plugin For WordPress exact-links
WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible wc-frontend-manager
Widget for Google Reviews business-reviews-wp
Wishlist for WooCommerce: Multi Wishlists Per Customer wish-list-for-woocommerce
WordPress Auto Spinner wp-auto-spinner
wordpress-flat-countdown wordpress-flat-countdown
WP Pipes wp-pipes
WP Register Profile With Shortcode wp-register-profile-with-shortcode
WP-BusinessDirectory – Business directory plugin for WordPress wp-businessdirectory
WPBookit wpbookit
WPC Smart Compare for WooCommerce woo-smart-compare
wpForo Forum wpforo
WPGYM – WordPress Gym Management System gym-management

WordPress Themes with Reported Vulnerabilities Last Week

Software Name Software Slug
electrician electrician
fwdevp fwdevp
Hillter – Responsive Hotel Booking for WordPress hillter
Invico – WordPress Consulting Business Theme invico
ListingEasy – Directory Listing WordPress Theme listingeasy
Noisa noisa
Nokri – Job Board WordPress Theme nokri
Nuss – Hotel Booking WordPress nuss
Ofiz – WordPress Business Consulting Theme ofiz
Sala – Startup & SaaS WordPress Theme sala
Travel Booking WordPress Theme traveler
Woodmart woodmart
Yogi – Health Beauty & Yoga WordPress Theme yogi

Vulnerability Details

Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.

GB Forms DB <= 1.0.2 – Unauthenticated Remote Code Execution

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-5392
Patch Status
Patched
Published
Jul 10, 2025
Affected Software
GB Forms DB
Researcher
More Details >

HTML5 Radio Player – WPBakery Page Builder Addon <= 2.5 – Unauthenticated Arbitrary File Upload

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-31070
Patch Status
Patched
Published
Jul 11, 2025
Affected Software
HTML5 Radio Player – WPBakery Page Builder Addon
Researcher
More Details >

Premium Age Verification / Restriction for WordPress <= 3.0.2 – Unauthenticated Arbitrary File Read and Write via remote_tunnel.php

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-7401
Patch Status
Unpatched
Published
Jul 10, 2025
Affected Software
Premium Age Verification / Restriction for WordPress
Researcher
More Details >

Sala – Startup & SaaS WordPress Theme <= 1.1.4 – Unauthenticated Privilege Escalation via Password Reset/Account Takeover

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-4606
Patch Status
Unpatched
Published
Jul 8, 2025
Affected Software
Sala – Startup & SaaS WordPress Theme
Researcher
More Details >

Support Board <= 3.8.0 – Unauthenticated Arbitrary File Deletion

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-4828
Patch Status
Patched
Published
Jul 8, 2025
Affected Software
Support Board
Researcher
More Details >

Support Board <= 3.8.0 – Unauthenticated Authorization Bypass due to Use of Default Secret Key

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-4855
Patch Status
Patched
Published
Jul 8, 2025
Affected Software
Support Board
Researcher
More Details >

The E-Commerce ERP <= 2.1.1.3 – Unauthenticated Privilege Escalation

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-52836
Patch Status
Unpatched
Published
Jul 11, 2025
Affected Software
The E-Commerce ERP: Purchasing, Inventory, Fulfillment, Manufacturing, BOM, Accounting, Sales Analysis
Researcher
More Details >

WPBookit <= 1.0.4 – Unauthenticated Arbitrary File Upload

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-6058
Patch Status
Patched
Published
Jul 11, 2025
Affected Software
WPBookit
Researcher
More Details >

BeeTeam368 Extensions <= 2.3.5 – Authenticated (Subscriber+) Arbitrary File Upload

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-6423
Patch Status
Patched
Published
Jul 11, 2025
Affected Software
BeeTeam368 Extensions
Researcher
More Details >

Hillter <= 3.0.7 – Authenticated (Subscriber+) PHP Object Injection

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-24777
Patch Status
Unpatched
Published
Jul 8, 2025
Affected Software
Hillter – Responsive Hotel Booking for WordPress
Researcher
More Details >

Nokri – Job Board WordPress Theme <= 1.6.3 – Authenticated (Subscriber+) Privilege Escalation via Account Takeover

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-1313
Patch Status
Patched
Published
Jul 11, 2025
Affected Software
Nokri – Job Board WordPress Theme
Researcher
More Details >

Responsive Coming Soon Landing Page / Holding Page for WordPress <= 3.0 – Authenticated (Susbcriber+) Privilege Escalation

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-29004
Patch Status
Unpatched
Published
Jul 8, 2025
Affected Software
wordpress-flat-countdown
Researcher
More Details >

Widget for Google Reviews <= 1.0.15 – Authenticated (Subscriber+) Directory Traversal to Local File Inclusion

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-7327
Patch Status
Patched
Published
Jul 7, 2025
Affected Software
Widget for Google Reviews
Researcher
More Details >

WoodMart <= 8.2.3 – Authenticated (Contributor+) Local File Inclusion

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-6746
Patch Status
Patched
Published
Jul 7, 2025
Affected Software
Woodmart
Researcher
More Details >

WPBookit <= 1.0.4 – Authenticated (Subscriber+) Arbitrary File Upload

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-6057
Patch Status
Patched
Published
Jul 11, 2025
Affected Software
WPBookit
Researcher
More Details >

Yogi <= 2.9.0 – Authenticated (Subscriber+) PHP Object Injection

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-24779
Patch Status
Unpatched
Published
Jul 8, 2025
Affected Software
Yogi – Health Beauty & Yoga WordPress Theme
Researcher
More Details >

CoSchool LMS <= 1.4.3 – Unauthenticated PHP Object Injection

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2025-30973
Patch Status
Unpatched
Published
Jul 7, 2025
Affected Software
CoSchool LMS – A complete Learning Management System to Create and Sell Your Courses Online
Researcher
More Details >

Site Chat on Telegram <= 1.0.4 – Unauthenticated PHP Object Injection

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2025-30949
Patch Status
Patched
Published
Jul 7, 2025
Affected Software
Site Chat on Telegram
Researcher
More Details >

Super Store Finder <= 6.9.7 – Unauthenticated Local File Inclusion

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2025-47571
Patch Status
Unpatched
Published
Jul 7, 2025
Affected Software
Super Store Finder
Researcher
More Details >

SureForms – Drag and Drop Form Builder for WordPress <= 1.7.3 – Unauthenticated Arbitrary File Deletion Triggered via Administrator Submission Deletion

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2025-6691
Patch Status
Patched
Published
Jul 8, 2025
Affected Software
SureForms – Drag and Drop Form Builder for WordPress
Researcher
More Details >

URL Shortener <= 3.0.7 – Unauthenticated PHP Object Injection

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2025-28961
Patch Status
Unpatched
Published
Jul 11, 2025
Affected Software
URL Shortener Plugin For WordPress
Researcher
More Details >

Events Manager <= 7.0.3 – Unauthenticated SQL Injection via `orderby` Parameter

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2025-6970
Patch Status
Patched
Published
Jul 9, 2025
Affected Software
Events Manager – Calendar, Bookings, Tickets, and more!
Researcher
More Details >

Friends 3.5.1 – Authenticated (Subscriber+) PHP Object Injection

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2025-7504
Patch Status
Patched
Published
Jul 11, 2025
Affected Software
Friends
Researcher
More Details >

Noisa <= 2.6.0 – Authenticated (Subscriber+) PHP Object Injection

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2025-53560
Patch Status
Patched
Published
Jul 8, 2025
Affected Software
Noisa
Researcher
More Details >

SureForms – Drag and Drop Form Builder for WordPress <= 1.7.3 – Unauthenticated PHP Object Injection (PHAR) Triggered via Admin Submission Deletion

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2025-6742
Patch Status
Patched
Published
Jul 8, 2025
Affected Software
SureForms – Drag and Drop Form Builder for WordPress
Researcher
More Details >

Torod <= 1.9 – Unauthenticated SQL Injection

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2025-30936
Patch Status
Unpatched
Published
Jul 7, 2025
Affected Software
Torod – The smart shipping and delivery portal for e-shops and retailers
Researcher
More Details >

Traveler < 3.2.2 – Unauthenticated SQL Injection

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2025-52714
Patch Status
Patched
Published
Jul 10, 2025
Affected Software
Travel Booking WordPress Theme
Researcher
More Details >

URL Shortener <= 3.0.7 – Unauthenticated SQL Injection

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2025-28959
Patch Status
Unpatched
Published
Jul 11, 2025
Affected Software
URL Shortener Plugin For WordPress
Researcher
More Details >

WP Pipes <= 1.4.3 – Unauthenticated SQL Injection

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2025-28982
Patch Status
Unpatched
Published
Jul 8, 2025
Affected Software
WP Pipes
Researcher
More Details >

WP-BusinessDirectory <= 3.1.3 – Unauthenticated SQL Injection

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2025-24759
Patch Status
Unpatched
Published
Jul 11, 2025
Affected Software
WP-BusinessDirectory – Business directory plugin for WordPress
Researcher
More Details >

WPGYM – WordPress Gym Management System < 67.8.0 – Unauthenticated SQL Injection

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2025-7442
Patch Status
Unpatched
Published
Jul 10, 2025
Affected Software
WPGYM – WordPress Gym Management System
Researcher
More Details >

Woodmart <= 8.2.3 – Unauthenticated Arbitrary Shortcode Execution

7.3
CVSS Rating
High (7.3)
CVE-ID
CVE-2025-6744
Patch Status
Patched
Published
Jul 7, 2025
Affected Software
Woodmart
Researcher
More Details >

Broken Link Notifier <= 1.3.0 – Unauthenticated Server-Side Request Forgery

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2025-6851
Patch Status
Patched
Published
Jul 10, 2025
Affected Software
Broken Link Notifier
Researcher
More Details >

Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer) <= 1.2 – Authenticated (Subscriber+) SQL Injection

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2025-30628
Patch Status
Unpatched
Published
Jul 7, 2025
Affected Software
Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer)
Researcher
More Details >

Easy Video Player WordPress & WooCommerce <= 10.0 – Unauthenticated Arbitrary File Download

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2025-28955
Patch Status
Unpatched
Published
Jul 7, 2025
Affected Software
fwdevp
Researcher
More Details >

Pakke Envíos <= 1.0.2 – Authenticated (Subscriber+) SQL Injection

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2025-52819
Patch Status
Unpatched
Published
Jul 8, 2025
Affected Software
Pakke Envíos
Researcher
More Details >

Premium SEO Pack <= 3.3.2 – Authenticated (Subscriber+) SQL Injection

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2025-31044
Patch Status
Unpatched
Published
Jul 8, 2025
Affected Software
Premium SEO Pack – WP SEO Plugin
Researcher
More Details >

ProfileGrid <= 5.9.5.2 – Authenticated (Subscriber+) SQL Injection

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2025-49876
Patch Status
Patched
Published
Jul 10, 2025
Affected Software
ProfileGrid – User Profiles, Groups and Communities
Researcher
More Details >

smart SEO <= 4.0 – Authenticated (Subscriber+) SQL Injection

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2025-28953
Patch Status
Unpatched
Published
Jul 8, 2025
Affected Software
SmartSEO | SEO & Marketing Services WordPress Theme
Researcher
More Details >

WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.16 – Missing Authorization to Unauthenticated Plugin Settings Modification

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2025-3780
Patch Status
Patched
Published
Jul 8, 2025
Affected Software
WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible
Researcher
More Details >

WP Register Profile With Shortcode <= 3.6.2 – Authenticated (Contributor+) Sensitive Information Exposure

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2025-4593
Patch Status
Patched
Published
Jul 10, 2025
Affected Software
WP Register Profile With Shortcode
Researcher
More Details >

WPGYM <= 65.0 – Authenticated (Subscriber+) SQL Injection

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2025-32574
Patch Status
Unpatched
Published
Jul 8, 2025
Affected Software
WPGYM – WordPress Gym Management System
Researcher
More Details >

Contest Gallery <= 26.0.8 – Authenticated (Author+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-6716
Patch Status
Patched
Published
Jul 10, 2025
Affected Software
Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons, OpenAI
Researcher
More Details >

Essential Addons for Elementor – Popular Elementor Templates and Widgets <= 6.1.19 – Authenticated (Contributor+) Stored Cross-Site Scripting via `Calendar` And `Business Reviews` Widgets

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-6244
Patch Status
Patched
Published
Jul 7, 2025
Affected Software
Essential Addons for Elementor – Popular Elementor Templates & Widgets
Researcher
More Details >

Events Manager <= 7.0.3 – Authenticated(Contributor+) Stored Cross-Site Scripting via Plugin Shortcodes

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-6976
Patch Status
Patched
Published
Jul 9, 2025
Affected Software
Events Manager – Calendar, Bookings, Tickets, and more!
Researcher
More Details >

FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel <= 2.4.31 – Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-6068
Patch Status
Patched
Published
Jul 10, 2025
Affected Software
FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel
Researcher
More Details >

Kadence Blocks – Gutenberg Blocks for Page Builder Features <= 3.5.10 – Authenticated (Contributor+) Stored Cross-Site Scripting via `redirectURL` Parameter

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-5678
Patch Status
Patched
Published
Jul 8, 2025
Affected Software
Gutenberg Blocks with AI by Kadence WP – Page Builder Features
Researcher
More Details >

Lightbox & Modal Popup WordPress Plugin – FooBox <= 2.7.34 – Authenticated (Author+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-5537
Patch Status
Patched
Published
Jul 7, 2025
Affected Software
Lightbox & Modal Popup WordPress Plugin – FooBox
Researcher
More Details >

Simple Featured Image <= 1.3.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via slideshow Parameter

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-7059
Patch Status
Unpatched
Published
Jul 8, 2025
Affected Software
Simple Featured Image
Researcher
More Details >

WoodMart <= 8.2.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-6743
Patch Status
Patched
Published
Jul 7, 2025
Affected Software
Woodmart
Researcher
More Details >

WPC Smart Compare for WooCommerce <= 6.4.6 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-5530
Patch Status
Patched
Published
Jul 10, 2025
Affected Software
WPC Smart Compare for WooCommerce
Researcher
More Details >

Contact Form 7 Editor Button <= 1.0.0 – Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-48345
Patch Status
Unpatched
Published
Jul 7, 2025
Affected Software
Contact Form 7 Editor Button
Researcher
More Details >

Contest Gallery <= 26.0.6 – Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-48291
Patch Status
Patched
Published
Jul 11, 2025
Affected Software
Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons, OpenAI
Researcher
More Details >

CSS3 Compare Pricing Tables for WordPress <= 11.6 – Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-47554
Patch Status
Patched
Published
Jul 7, 2025
Affected Software
CSS3 Compare Pricing Tables for WordPress
Researcher
More Details >

Dot html,php,xml etc pages <= 1.0 – Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-52779
Patch Status
Unpatched
Published
Jul 7, 2025
Affected Software
Dot html,php,xml etc pages
Researcher
More Details >

Electrician – Electrical Service WordPress <= 1.0 – Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-31055
Patch Status
Unpatched
Published
Jul 7, 2025
Affected Software
electrician
Researcher
More Details >

Event Manager <= 7.0.3 – Reflected Cross-Site Scripting via `calendar_header` Parameter

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-6975
Patch Status
Patched
Published
Jul 9, 2025
Affected Software
Events Manager – Calendar, Bookings, Tickets, and more!
Researcher
More Details >

Gwolle Guestbook <= 4.9.2 – Unauthenticated Stored Cross-Site Scripting via `gwolle_gb_content` Parameter

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-5807
Patch Status
Patched
Published
Jul 9, 2025
Affected Software
Gwolle Guestbook
Researcher
More Details >

Infility Global <= 2.13.4 – Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-47652
Patch Status
Patched
Published
Jul 7, 2025
Affected Software
Infility Global
Researcher
More Details >

Invico – WordPress Consulting Business Theme <= 1.9 – Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-31427
Patch Status
Unpatched
Published
Jul 7, 2025
Affected Software
Invico – WordPress Consulting Business Theme
Researcher
More Details >

ListingEasy <= 1.9.2 – Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-30955
Patch Status
Unpatched
Published
Jul 7, 2025
Affected Software
ListingEasy – Directory Listing WordPress Theme
Researcher
More Details >

Media Folder <= 1.0.0 – Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-52786
Patch Status
Unpatched
Published
Jul 7, 2025
Affected Software
Media Folder
Researcher
More Details >

Ofiz – WordPress Business Consulting Theme <= 2.0 – Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-31072
Patch Status
Unpatched
Published
Jul 7, 2025
Affected Software
Ofiz – WordPress Business Consulting Theme
Researcher
More Details >

Pay with Contact Form 7 <= 1.0.4 – Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-52777
Patch Status
Unpatched
Published
Jul 7, 2025
Affected Software
Pay with Contact Form 7
Researcher
More Details >

SMu Manual DoFollow <= 1.8.1 – Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-49031
Patch Status
Unpatched
Published
Jul 7, 2025
Affected Software
SMu Manual DoFollow
Researcher
More Details >

Tennis Court Bookings <= 1.2.7 – Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-52787
Patch Status
Unpatched
Published
Jul 7, 2025
Affected Software
Tennis Court Bookings
Researcher
More Details >

WordPress Auto Spinner <= 3.25.0 – Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-46500
Patch Status
Unpatched
Published
Jul 7, 2025
Affected Software
WordPress Auto Spinner
Researcher
More Details >

Modern Events Calendar Lite <= 6.3.0 – Unauthenticated SQL Injection

5.9
CVSS Rating
Medium (5.9)
CVE-ID
CVE-2021-4458
Patch Status
Patched
Published
Jul 11, 2025
Affected Software
Modern Events Calendar Lite
Researcher(s): Unknown
More Details >

Lana Downloads Manager <= 1.10.0 – Authenticated (Administrator+) Stored Cross-Site Scripting

5.5
CVSS Rating
Medium (5.5)
CVE-ID
CVE-2025-7387
Patch Status
Patched
Published
Jul 9, 2025
Affected Software
Lana Downloads Manager
Researcher
More Details >

AI Engine <= 2.8.4 – Authenticated (Subscriber+) Stored Cross-Site Scripting via `mwai_chatbot` Shortcode `id` Parameter

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2025-5570
Patch Status
Patched
Published
Jul 7, 2025
Affected Software
AI Engine
Researcher
More Details >

wpForo Forum <= 2.4.5 – Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Avatar

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2025-4406
Patch Status
Patched
Published
Jul 9, 2025
Affected Software
wpForo Forum
Researcher
More Details >

Guest Support – Complete customer support ticket system for WordPress <= 1.2.2 – Missing Authorization to Unauthenticated Ticket Deletion

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-5957
Patch Status
Patched
Published
Jul 7, 2025
Affected Software
Guest Support – Complete customer support ticket system for WordPress
Researcher
More Details >

Internal Linking of Related Contents <= 1.1.8 – Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-49884
Patch Status
Patched
Published
Jul 8, 2025
Affected Software
Internal Linking of Related Contents
Researcher
More Details >

LoginWP – Pro <= 4.0.8.5 – Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-39561
Patch Status
Unpatched
Published
Jul 7, 2025
Affected Software
LoginWP – Pro
Researcher
More Details >

Multi-language Responsive Contact Form <= 2.8 – Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-29000
Patch Status
Unpatched
Published
Jul 7, 2025
Affected Software
Multi-language Responsive Contact Form
Researcher
More Details >

Nuss <= 1.3.3 – Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-52804
Patch Status
Unpatched
Published
Jul 8, 2025
Affected Software
Nuss – Hotel Booking WordPress
Researcher
More Details >

Product XML Feed Manager for WooCommerce <= 2.9.2 – Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-30959
Patch Status
Patched
Published
Jul 11, 2025
Affected Software
Product XML Feed Manager for WooCommerce – Google Shopping, Social Sites, Skroutz & More
Researcher
More Details >

Profiler – What Slowing Down Your WP <= 1.0.0 – Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-48339
Patch Status
Unpatched
Published
Jul 7, 2025
Affected Software
Profiler – What Slowing Down Your WP
Researcher
More Details >

Sala <= 1.1.3 – Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-52803
Patch Status
Unpatched
Published
Jul 8, 2025
Affected Software
Sala – Startup & SaaS WordPress Theme
Researcher
More Details >

Ultimate Push Notifications <= 1.1.9 – Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-50028
Patch Status
Unpatched
Published
Jul 7, 2025
Affected Software
Ultimate Push Notifications ( Mobile / Desktop ), Receive Notification From WooCommerce, BuddyPress, WordPress Default Events & Many More
Researcher
More Details >

Wishlist for WooCommerce <= 3.2.3 – Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-49319
Patch Status
Patched
Published
Jul 10, 2025
Affected Software
Wishlist for WooCommerce: Multi Wishlists Per Customer
Researcher
More Details >

WoodMart <= 8.2.5 – Unauthenticated Post Disclosure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-6745
Patch Status
Patched
Published
Jul 10, 2025
Affected Software
Woodmart
Researcher
More Details >

Funnel Builder by FunnelKit <= 3.10.2 – Authenticated (Administrator+) SQL Injection

4.9
CVSS Rating
Medium (4.9)
CVE-ID
CVE-2025-49034
Patch Status
Patched
Published
Jul 8, 2025
Affected Software
FunnelKit – Funnel Builder for WooCommerce Checkout
Researcher
More Details >

RSFirewall! <= 1.1.42 – Authenticated (Admin+) Arbitrary File Read

4.9
CVSS Rating
Medium (4.9)
CVE-ID
CVE-2025-7518
Patch Status
Patched
Published
Jul 11, 2025
Affected Software
RSFirewall!
Researchers
More Details >

Pro Bulk Watermark Plugin for WordPress <= 2.0 – Authenticated (Subscriber+) Path Traversal

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-28973
Patch Status
Unpatched
Published
Jul 10, 2025
Affected Software
Pro Bulk Watermark Plugin for WordPress
Researcher
More Details >

PW WooCommerce On Sale! <= 1.39 – Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-49888
Patch Status
Patched
Published
Jul 7, 2025
Affected Software
PW WooCommerce On Sale!
Researcher
More Details >

Broken Link Notifier <= 1.3.0 – Authenticated (Contributor+) CSV Injection

4.1
CVSS Rating
Medium (4.1)
CVE-ID
CVE-2025-6838
Patch Status
Patched
Published
Jul 10, 2025
Affected Software
Broken Link Notifier
Researcher
More Details >

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

The post Wordfence Intelligence Weekly WordPress Vulnerability Report (July 7, 2025 to July 13, 2025) appeared first on Wordfence.

Leave a Comment