Wordfence Intelligence Weekly WordPress Vulnerability Report (November 10, 2025 to November 16, 2025)

by

📢 Calling all Vulnerability Researchers and Bug Bounty Hunters! 📢

📁 The LFInder Challenge: Refine your LFI hunting skills with an expanded scope. Now through November 24, 2025, all LFI vulnerabilities in software with at least 25 active installs are considered in-scope for all researchers, regardless of researcher tier, AND earn a 30% bonus on all Local File Inclusion vulnerability submissions not already increased by another promotion.

Last week, there were 106 vulnerabilities disclosed in 100 WordPress Plugins and 1 WordPress Theme that have been added to the Wordfence Intelligence Vulnerability Database, and there were 48 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back.

Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 29,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

New Firewall Rules Deployed Last Week

The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.

The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:

Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.

Total Unpatched & Patched Vulnerabilities Last Week

Patch Status Number of Vulnerabilities
Patched 49
Unpatched 57

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating Number of Vulnerabilities
Medium Severity 89
High Severity 13
Critical Severity 4

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE Number of Vulnerabilities
Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) 40
Missing Authorization 21
Cross-Site Request Forgery (CSRF) 7
Authorization Bypass Through User-Controlled Key 6
Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) 6
Exposure of Sensitive Information to an Unauthorized Actor 4
Improper Control of Generation of Code (‘Code Injection’) 3
Improper Privilege Management 3
Improper Authorization 2
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) 2
Unrestricted Upload of File with Dangerous Type 2
Client-Side Enforcement of Server-Side Security 1
Deserialization of Untrusted Data 1
Exposure of Private Personal Information to an Unauthorized Actor 1
External Control of File Name or Path 1
Improper Access Control 1
Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) 1
Insecure Storage of Sensitive Information 1
Insertion of Sensitive Information into Externally-Accessible File or Directory 1
Missing Authentication for Critical Function 1
Use of Insufficiently Random Values 1

Researchers That Contributed to WordPress Security Last Week

Researcher Name Number of Vulnerabilities
12
12
8
6
5
4
4
3
3
3
3
3
3
3
2
2
2
2
2
1
1
1
1
1
1
1
1

kai
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name Software Slug
0 Day Analytics 0-day-analytics
Add Multiple Marker add-multiple-marker
AI Engine ai-engine
AI-Powered Project Management & Task Manager with Kanban Board & Gantt Chart – WP Project Manager wedevs-project-manager
All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic all-in-one-seo-pack
Alt Text Generator AI – Auto Generate & Bulk Update Alt Texts For Images alt-text-generator
Appointment Booking Calendar appointment-booking-calendar
Asgaros Forum asgaros-forum
Astra Security Suite – Firewall & Malware Scan getastra
Authors List authors-list
Auto Amazon Links – Amazon Associates Affiliate Plugin amazon-auto-links
Blocksy Companion blocksy-companion
Booking Calendar booking
Booking Calendar | Appointment Booking | Bookit bookit
Booking for Appointments and Events Calendar – Amelia ameliabooking
Chart Expert chart-expert
Classified Listing – AI-Powered Classified ads & Business Directory Plugin classified-listing
Comment Edit Core – Simple Comment Editing simple-comment-editing
Contact Form Email contact-form-to-email
Contest Gallery – Upload, Vote & Sell with PayPal and Stripe contest-gallery
Convert WebP & AVIF | Quicq | Best image optimizer and compression plugin | Improve your Google Pagespeed quicq
Coon Google Maps coon-google-maps
Crypto Tool crypto
CTL Arcade Lite ctl-arcade-lite
Data Tables Generator by Supsystic data-tables-generator-by-supsystic
Document Pro Elementor – Documentation & Knowledge Base document-pro-elementor
Double the Donation – A workplace giving tool double-the-donation
Easy Email Subscription email-subscription-with-secure-captcha
EasyCommerce – AI-Powered Ecommerce To Sell Physical & Digital Products easycommerce
Elastic Theme Editor elastic-theme-editor
Eventbee Ticketing Widget eventbee-ticketing-widget
Featured Image featured-image
Find Unused Images find-unused-images
Five9 Live Chat five9
Fleet Manager fleet
Flickr Show wp-flickrshow
Gallery Plugin for WordPress – Envira Photo Gallery envira-gallery-lite
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory geodirectory
Geopost geopost
GitHub Gist Shortcode Plugin github-gist-shortcode
Holiday class post calendar holiday-class-post-calendar
Hydra Booking — Appointment Scheduling & Booking Calendar hydra-booking
Image Gallery – Photo Grid & Video Gallery modula-best-grid-gallery
Import any XML, CSV or Excel File to WordPress wp-all-import
Include Fussball.de Widgets include-fussball-de-widgets
Jeba Cute forkit jeba-cute-forkit
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes lifterlms
Live Photos on WordPress live-photos
Magazine Companion bnm-blocks
MembershipWorks – Membership, Events & Directory memberfindme
Mementor Core mementor-core
My Geo Posts Free my-geo-posts-free
Ninja Countdown | Fastest Countdown Builder ninja-countdown
Nonaki – Drag and Drop Email Template builder and Newsletter plugin for WordPress nonaki-email-template-customizer
Page Builder: Pagelayer – Drag and Drop website builder pagelayer
Payment Plugins Braintree For WooCommerce woo-payment-gateway
Paypal Donation Shortcode paypal-donation-shortcode
PDF Builder for WooCommerce. Create invoices,packing slips and more woo-pdf-invoice-builder
Poll Maker – Versus Polls, Anonymous Polls, Image Polls poll-maker
Precise Columns precise-columns
Preload Current Images preload-current-images
Private Google Calendars private-google-calendars
Progress Bar Blocks for Gutenberg progressmatify-blocks
Qi Blocks qi-blocks
RandomQuotr randomquotr
Save as PDF Button save-as-pdf
School Management System – WPSchoolPress wpschoolpress
Share to Google Classroom share-to-google-classroom
Simple Donate simple-donate
Skip to Timestamp skip-to-timestamp
Slippy Slider – Responsive Touch Navigation Slider slippy-slider-responsive-touch-navigation-slider
SNORDIAN’s H5PxAPIkatchu h5pxapikatchu
Specific Content For Mobile – Customize the mobile version without redirections specific-content-for-mobile
Squirrels Auto Inventory squirrels-auto-inventory
Stock Management for WooCommerce by Shelf Planner shelf-planner
SureForms – Contact Form, Custom Form Builder, Calculator & More sureforms
Survey Maker survey-maker
The Total Book Project the-total-book-project
Theater for WordPress theatre
Thumbnail Slider With Lightbox wp-responsive-slider-with-lightbox
TNC Toolbox: Web Performance tnc-toolbox
Twitter Feed ot-twitter-feed
Ungapped Widgets ungapped-widgets
USB Qr Code Scanner For Woocommerce usb-qr-code-scanner-for-woocommerce
Welcart e-Commerce usc-e-shop
Wishlist and Save for later for Woocommerce aco-wishlist-for-woocommerce
Wisly wisly
Woocommerce – Products By Custom Tax woocommerce-products-by-custom-tax
WordPress Content Flipper wp-flipper
WP BBCode wp-bbcode
WP Bootstrap Tabs wp-bootstrap-tabs
WP Count Down Timer wp-count-down-timer
WP Custom Admin Login Page Logo wp-custom-login-page-logo
WP Import – Ultimate CSV XML Importer for WordPress wp-ultimate-csv-importer
WP Plugin Manager – Deactivate plugins per page wp-plugin-manager
WP-Iconics wp-iconics
WP-OAuth wp-oauth
WP-Walla wp-walla
WP移行専用プラグイン for CPI cpi-wp-migration
YSlider yslider

WordPress Themes with Reported Vulnerabilities Last Week

Software Name Software Slug
Angel – Fashion Model Agency WordPress CMS Theme angel

Vulnerability Details

Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.

TNC Toolbox: Web Performance <= 1.4.2 – Unauthenticated Sensitive Information Exposure to Privilege Escalation/cPanel Account Takeover

10.0
CVSS Rating
Critical (10.0)
CVE-ID
CVE-2025-12539
Patch Status
Patched
Published
Nov 10, 2025
Affected Software
TNC Toolbox: Web Performance
Researcher
More Details >

EasyCommerce – AI-Powered, Blazing-Fast & Beautiful WordPress Ecommerce Plugin 0.9.0-beta2 – 1.8.2 – Unauthenticated Privilege Escalation

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-11457
Patch Status
Patched
Published
Nov 10, 2025
Affected Software
EasyCommerce – AI-Powered Ecommerce To Sell Physical & Digital Products
Researcher
More Details >

Holiday class post calendar <= 7.1 – Unauthenticated Remote Code Execution via ‘contents’

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-12813
Patch Status
Unpatched
Published
Nov 10, 2025
Affected Software
Holiday class post calendar
Researcher
More Details >

WP移行専用プラグイン for CPI <= 1.0.2 – Unauthenticated Arbitrary File Upload

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2025-11170
Patch Status
Unpatched
Published
Nov 10, 2025
Affected Software
WP移行専用プラグイン for CPI
Researcher
More Details >

Blocksy Companion <= 2.1.19 – Authenticated (Author+) Arbitrary File Upload via SVG Upload Bypass

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-12846
Patch Status
Patched
Published
Nov 10, 2025
Affected Software
Blocksy Companion
Researcher
More Details >

Elastic Theme Editor <= 0.0.3 – Authenticated (Subscriber+) Arbitrary File Upload

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-12637
Patch Status
Unpatched
Published
Nov 10, 2025
Affected Software
Elastic Theme Editor
Researcher
More Details >

Import any XML, CSV or Excel File to WordPress (WP All Import) <= 3.9.6 – Authenticated (Administrator+) Remote Code Execution via Conditional Logic

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-12733
Patch Status
Patched
Published
Nov 12, 2025
Affected Software
Import any XML, CSV or Excel File to WordPress
Researcher
More Details >

LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes – Various Versions – Authenticated (Student+) Privilege Escalation

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-11923
Patch Status
Patched
Published
Nov 12, 2025
Affected Software
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes
Researcher
More Details >

Mementor Core <= 2.2.5 – Authenticated (Subscriber+) Privilege Escalation

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2025-11168
Patch Status
Unpatched
Published
Nov 10, 2025
Affected Software
Mementor Core
Researcher
More Details >

Astra Security Suite – Firewall & Malware Scan <= 0.2 – Unauthenticated Arbitrary File Upload

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2025-11521
Patch Status
Unpatched
Published
Nov 10, 2025
Affected Software
Astra Security Suite – Firewall & Malware Scan
Researcher
More Details >

Auto Amazon Links – Amazon Associates Affiliate Plugin <= 5.4.3 – Unauthenticated Arbitrary File Read

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2025-11451
Patch Status
Unpatched
Published
Nov 10, 2025
Affected Software
Auto Amazon Links – Amazon Associates Affiliate Plugin
Researcher
More Details >

Booking Calendar | Appointment Booking | Bookit <= 2.5.0 – Missing Authorization to Unauthenticated Stripe Connection

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2025-12633
Patch Status
Patched
Published
Nov 11, 2025
Affected Software
Booking Calendar | Appointment Booking | Bookit
Researcher
More Details >

Booking for Appointments and Events Calendar – Amelia <= 1.2.35 – Unauthenticated SQL Injection via search

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2025-12482
Patch Status
Patched
Published
Nov 15, 2025
Affected Software
Booking for Appointments and Events Calendar – Amelia
Researcher
More Details >

Payment Plugins Braintree For WooCommerce <= 3.2.78 – Missing Authorization to Payment Token Exposure and Transaction Fraud

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2025-12903
Patch Status
Patched
Published
Nov 11, 2025
Affected Software
Payment Plugins Braintree For WooCommerce
Researcher
More Details >

Easy Email Subscription <= 1.3 – Unauthenticated Stored Cross-Site Scripting

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2025-11994
Patch Status
Patched
Published
Nov 11, 2025
Affected Software
Easy Email Subscription
Researcher
More Details >

SNORDIAN’s H5PxAPIkatchu <= 0.4.17 – Unauthenticated Stored Cross-Site Scripting via insert_data

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2025-12904
Patch Status
Patched
Published
Nov 13, 2025
Affected Software
SNORDIAN’s H5PxAPIkatchu
Researcher
More Details >

AI Engine <= 3.1.8 – Authenticated (Subscriber+) PHP Object Injection via PHAR Deserialization

7.1
CVSS Rating
High (7.1)
CVE-ID
CVE-2025-12844
Patch Status
Patched
Published
Nov 12, 2025
Affected Software
AI Engine
Researcher
More Details >

Authors List <= 2.0.6.1 – Authenticated (Contributor+) Sensitive Information Exposure via Limited Method Call in Plugin’s Shortcode

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2025-12010
Patch Status
Unpatched
Published
Nov 10, 2025
Affected Software
Authors List
Researcher
kai
More Details >

Data Tables Generator by Supsystic <= 1.10.45 – Authenticated (Admin+) Arbitrary File Deletion

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2025-12089
Patch Status
Patched
Published
Nov 12, 2025
Affected Software
Data Tables Generator by Supsystic
Researcher
More Details >

Specific Content For Mobile – Customize the mobile version without redirections <= 0.5.5 – Authenticated (Contributor+) SQL Injection

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2025-11454
Patch Status
Patched
Published
Nov 11, 2025
Affected Software
Specific Content For Mobile – Customize the mobile version without redirections
Researcher
More Details >

WP Project Manager <= 2.6.26 – Authenticated (Subscriber+) SQL Injection via ‘completed_at_operator’

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2025-8994
Patch Status
Patched
Published
Nov 14, 2025
Affected Software
AI-Powered Project Management & Task Manager with Kanban Board & Gantt Chart – WP Project Manager
Researcher
More Details >

Angel – Fashion Model Agency WordPress CMS Theme <= 3.2.3 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-10295
Patch Status
Unpatched
Published
Nov 12, 2025
Affected Software
Angel – Fashion Model Agency WordPress CMS Theme
Researchers
More Details >

Booking Calendar <= 10.14.7 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-64381
Patch Status
Patched
Published
Nov 13, 2025
Affected Software
Booking Calendar
Researcher
More Details >

Chart Expert <= 1.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-12753
Patch Status
Unpatched
Published
Nov 10, 2025
Affected Software
Chart Expert
Researcher
More Details >

Coon Google Maps <= 1.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-12662
Patch Status
Unpatched
Published
Nov 10, 2025
Affected Software
Coon Google Maps
Researcher
More Details >

Eventbee Ticketing Widget <= 1.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-11856
Patch Status
Unpatched
Published
Nov 10, 2025
Affected Software
Eventbee Ticketing Widget
Researcher
More Details >

Five9 Live Chat <= 1.1.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-11829
Patch Status
Unpatched
Published
Nov 10, 2025
Affected Software
Five9 Live Chat
Researcher
More Details >

Flickr Show <= 1.5 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-12672
Patch Status
Unpatched
Published
Nov 10, 2025
Affected Software
Flickr Show
Researcher
More Details >

Geopost <= 1.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-12754
Patch Status
Unpatched
Published
Nov 10, 2025
Affected Software
Geopost
Researcher
More Details >

GitHub Gist Shortcode Plugin <= 0.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-12667
Patch Status
Unpatched
Published
Nov 10, 2025
Affected Software
GitHub Gist Shortcode Plugin
Researcher
More Details >

Include fussball.de Widgets <= 4.0.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘api’ and ‘type’

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-11129
Patch Status
Unpatched
Published
Nov 10, 2025
Affected Software
Include Fussball.de Widgets
Researchers
More Details >

Jeba Cute forkit <= 1.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-12663
Patch Status
Unpatched
Published
Nov 10, 2025
Affected Software
Jeba Cute forkit
Researcher
More Details >

Live Photos on WordPress <= 0.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-12651
Patch Status
Unpatched
Published
Nov 10, 2025
Affected Software
Live Photos on WordPress
Researcher
More Details >

Magazine Companion <= 1.2.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-11828
Patch Status
Patched
Published
Nov 10, 2025
Affected Software
Magazine Companion
Researcher
More Details >

My Geo Posts Free <= 1.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-11863
Patch Status
Unpatched
Published
Nov 10, 2025
Affected Software
My Geo Posts Free
Researcher
More Details >

Nonaki – Drag and Drop Email Template builder and Newsletter plugin for WordPress <= 1.0.11 – Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Fields

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-12644
Patch Status
Unpatched
Published
Nov 10, 2025
Affected Software
Nonaki – Drag and Drop Email Template builder and Newsletter plugin for WordPress
Researcher
More Details >

Paypal Donation Shortcode <= 0.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-11859
Patch Status
Unpatched
Published
Nov 10, 2025
Affected Software
Paypal Donation Shortcode
Researcher
More Details >

Precise Columns <= 1.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-11869
Patch Status
Unpatched
Published
Nov 10, 2025
Affected Software
Precise Columns
Researcher
More Details >

Preload Current Images <= 1.3 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-12658
Patch Status
Unpatched
Published
Nov 10, 2025
Affected Software
Preload Current Images
Researcher
More Details >

Save as PDF Button <= 1.9.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via restpackpdfbutton Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-8397
Patch Status
Unpatched
Published
Nov 12, 2025
Affected Software
Save as PDF Button
Researcher
More Details >

Share to Google Classroom <= 1.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via share_to_google Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-12711
Patch Status
Unpatched
Published
Nov 10, 2025
Affected Software
Share to Google Classroom
Researcher
More Details >

Simple Donate <= 1.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-11882
Patch Status
Unpatched
Published
Nov 10, 2025
Affected Software
Simple Donate
Researcher
More Details >

Skip to Timestamp <= 1.4.4 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-11805
Patch Status
Unpatched
Published
Nov 10, 2025
Affected Software
Skip to Timestamp
Researcher
More Details >

Thumbnail Slider With Lightbox <= 1.0.21 – Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5020
Patch Status
Patched
Published
Nov 11, 2025
Affected Software
Thumbnail Slider With Lightbox
Researcher
More Details >

Twitter Feed <= 1.3.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-11860
Patch Status
Unpatched
Published
Nov 10, 2025
Affected Software
Twitter Feed
Researcher
More Details >

Ungapped Widgets <= 1 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-12652
Patch Status
Unpatched
Published
Nov 10, 2025
Affected Software
Ungapped Widgets
Researcher
More Details >

Woocommerce – Products By Custom Tax <= 2.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-11821
Patch Status
Unpatched
Published
Nov 10, 2025
Affected Software
Woocommerce – Products By Custom Tax
Researcher
More Details >

WordPress Content Flipper <= 0.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-11769
Patch Status
Unpatched
Published
Nov 12, 2025
Affected Software
WordPress Content Flipper
Researcher
More Details >

WP BBCode <= 1.8.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-11873
Patch Status
Unpatched
Published
Nov 10, 2025
Affected Software
WP BBCode
Researcher
More Details >

WP Bootstrap Tabs <= 1.0.4 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-11822
Patch Status
Unpatched
Published
Nov 10, 2025
Affected Software
WP Bootstrap Tabs
Researcher
More Details >

WP Count Down Timer <= 1.0.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-12668
Patch Status
Unpatched
Published
Nov 10, 2025
Affected Software
WP Count Down Timer
Researcher
More Details >

WP-Iconics <= 0.0.4 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2025-12671
Patch Status
Unpatched
Published
Nov 10, 2025
Affected Software
WP-Iconics
Researcher
More Details >

WP-OAuth <= 0.4.1 – Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-12021
Patch Status
Unpatched
Published
Nov 10, 2025
Affected Software
WP-OAuth
Researcher
More Details >

WP-Walla <= 0.5.3.5 – Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-12589
Patch Status
Unpatched
Published
Nov 10, 2025
Affected Software
WP-Walla
Researcher
More Details >

YSlider <= 1.1 – Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2025-12590
Patch Status
Unpatched
Published
Nov 10, 2025
Affected Software
YSlider
Researcher
More Details >

RandomQuotr <= 1.0.4 – Authenticated (Admin+) Stored Cross-Site Scripting

5.5
CVSS Rating
Medium (5.5)
CVE-ID
CVE-2025-12632
Patch Status
Unpatched
Published
Nov 10, 2025
Affected Software
RandomQuotr
Researchers
More Details >

Progress Bar Blocks for Gutenberg <= 1.0.0 – Authenticated (Author+) Stored Cross-Site Scripting via SVG

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2025-12880
Patch Status
Unpatched
Published
Nov 10, 2025
Affected Software
Progress Bar Blocks for Gutenberg
Researcher
More Details >

Slippy Slider – Responsive Touch Navigation Slider <= 2.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2025-11874
Patch Status
Unpatched
Published
Nov 10, 2025
Affected Software
Slippy Slider – Responsive Touch Navigation Slider
Researcher
More Details >

The Total Book Project <= 1.0 – Insecure Direct Object Reference to Authenticated (Contributor+) Book Manipulation

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2025-12126
Patch Status
Patched
Published
Nov 10, 2025
Affected Software
The Total Book Project
Researcher
More Details >

Add Multiple Marker <= 1.2 – Missing Authorization to Unauthenticated Settings Update

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-11999
Patch Status
Unpatched
Published
Nov 10, 2025
Affected Software
Add Multiple Marker
Researcher
More Details >

Comment Edit Core – Simple Comment Editing <= 3.1.0 – Unauthenticated Sensitive Information Exposure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-12681
Patch Status
Patched
Published
Nov 12, 2025
Affected Software
Comment Edit Core – Simple Comment Editing
Researcher
More Details >

Contest Gallery <= 28.0.2 – Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-12849
Patch Status
Patched
Published
Nov 14, 2025
Affected Software
Contest Gallery – Upload, Vote & Sell with PayPal and Stripe
Researcher
More Details >

Crypto Tool <= 2.22 – Unauthenticated Information Exposure via Global Authentication State

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-11986
Patch Status
Unpatched
Published
Nov 10, 2025
Affected Software
Crypto Tool
Researcher
More Details >

Crypto Tool <= 2.22 – Missing Authentication to Unauthenticated Limited File Deletion

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-11988
Patch Status
Unpatched
Published
Nov 10, 2025
Affected Software
Crypto Tool
Researcher
More Details >

Document Pro Elementor – Documentation & Knowledge Base <= 1.0.9 – Unauthenticated Information Exposure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-11997
Patch Status
Unpatched
Published
Nov 10, 2025
Affected Software
Document Pro Elementor – Documentation & Knowledge Base
Researcher
More Details >

Find Unused Images <= 1.0.7 – Missing Authorization to Unauthenticated Arbitrary Attachment Deletion

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-11996
Patch Status
Unpatched
Published
Nov 10, 2025
Affected Software
Find Unused Images
Researcher
More Details >

Gallery Plugin for WordPress – Envira Photo Gallery <= 1.12.0 – Missing Authorization to Authenticated (Author+) Multiple Gallery Actions

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-12377
Patch Status
Patched
Published
Nov 12, 2025
Affected Software
Gallery Plugin for WordPress – Envira Photo Gallery
Researcher
More Details >

Hydra Booking – All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings <= 1.1.27 – Missing Payment Verification to Unauthenticated Payment Bypass

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-12788
Patch Status
Patched
Published
Nov 10, 2025
Affected Software
Hydra Booking — Appointment Scheduling & Booking Calendar
Researcher
More Details >

Hydra Booking – All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings <= 1.1.27 – Unauthenticated Arbitrary Booking Cancellation via Weak Hash Generation

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-12787
Patch Status
Patched
Published
Nov 10, 2025
Affected Software
Hydra Booking — Appointment Scheduling & Booking Calendar
Researcher
More Details >

Shelf Planner <= 2.7.0 – Missing Authorization to Unauthenticated Settings Update

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-11894
Patch Status
Unpatched
Published
Nov 10, 2025
Affected Software
Stock Management for WooCommerce by Shelf Planner
Researcher
More Details >

Shelf Planner <= 2.7.0 – Unauthenticated Information Exposure via Log Files

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-11891
Patch Status
Unpatched
Published
Nov 10, 2025
Affected Software
Stock Management for WooCommerce by Shelf Planner
Researcher
More Details >

SureForms <= 1.13.1 – Missing Authorization to Unauthenticated Sensitive Information Exposure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-12536
Patch Status
Patched
Published
Nov 12, 2025
Affected Software
SureForms – Contact Form, Custom Form Builder, Calculator & More
Researcher
More Details >

Survey Maker <= 5.1.9.4 – Missing Authorization to Unauthenticated Information Exposure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-12891
Patch Status
Patched
Published
Nov 12, 2025
Affected Software
Survey Maker
Researcher
More Details >

Survey Maker <= 5.1.9.4 – Missing Authorization to Unauthenticated Limited Option Update

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-12892
Patch Status
Patched
Published
Nov 12, 2025
Affected Software
Survey Maker
Researcher
More Details >

Theater for WordPress <= 0.18.8 – Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-64259
Patch Status
Patched
Published
Nov 13, 2025
Affected Software
Theater for WordPress
Researcher
More Details >

Welcart e-Commerce <= 2.11.24 – Missing Authorization to Unauthenticated Information Exposure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-12979
Patch Status
Patched
Published
Nov 12, 2025
Affected Software
Welcart e-Commerce
Researcher
More Details >

Wisly <= 1.0.0 – Insecure Direct Object Reference to Unauthenticated Wishlist Manipulation

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2025-11532
Patch Status
Unpatched
Published
Nov 10, 2025
Affected Software
Wisly
Researcher
More Details >

0 Day Analytics <= 4.0.0 – Authenticated (Administrator+) SQL Injection

4.9
CVSS Rating
Medium (4.9)
CVE-ID
CVE-2025-64293
Patch Status
Patched
Published
Nov 12, 2025
Affected Software
0 Day Analytics
Researcher
More Details >

Double the Donation <= 3.0.0 – Authenticated (Admin+) Stored Cross-Site Scripting

4.9
CVSS Rating
Medium (4.9)
CVE-ID
CVE-2025-12020
Patch Status
Patched
Published
Nov 10, 2025
Affected Software
Double the Donation – A workplace giving tool
Researchers
More Details >

Poll Maker – Versus Polls, Anonymous Polls, Image Polls <= 6.0.7 – Authenticated (Administrator+) SQL Injection via `filterbyauthor` Parameter

4.9
CVSS Rating
Medium (4.9)
CVE-ID
CVE-2025-12620
Patch Status
Patched
Published
Nov 12, 2025
Affected Software
Poll Maker – Versus Polls, Anonymous Polls, Image Polls
Researcher
More Details >

School Management System – WPSchoolPress <= 2.2.23 – Authenticated (Administrator+) SQL Injection

4.9
CVSS Rating
Medium (4.9)
CVE-ID
CVE-2025-11981
Patch Status
Patched
Published
Nov 13, 2025
Affected Software
School Management System – WPSchoolPress
Researcher
More Details >

Featured Image <= 2.1 – Authenticated (Admin+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2025-12019
Patch Status
Patched
Published
Nov 10, 2025
Affected Software
Featured Image
Researcher
More Details >

Fleet Manager <= 2.5.1 – Authenticated (Editor+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2025-12538
Patch Status
Unpatched
Published
Nov 10, 2025
Affected Software
Fleet Manager
Researchers
More Details >

MembershipWorks <= 6.14 – Authenticated (Admin+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2025-12018
Patch Status
Patched
Published
Nov 11, 2025
Affected Software
MembershipWorks – Membership, Events & Directory
Researcher
More Details >

Squirrels Auto Inventory <= 1.0.3 – Authenticated (Admin+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2025-12631
Patch Status
Unpatched
Published
Nov 10, 2025
Affected Software
Squirrels Auto Inventory
Researcher
More Details >

All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic <= 4.8.9 – Missing Authorization to Authenticated (Contributor+) Arbitrary Media Deletion

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-12847
Patch Status
Patched
Published
Nov 14, 2025
Affected Software
All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic
Researcher
More Details >

Alt Text Generator AI – Auto Generate & Bulk Update Alt Texts For Images <= 1.8.3 – Missing Authorization to Authenticated (Subscriber+) API Key Deletion

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-12113
Patch Status
Patched
Published
Nov 11, 2025
Affected Software
Alt Text Generator AI – Auto Generate & Bulk Update Alt Texts For Images
Researcher
More Details >

Appointment Booking Calendar <= 1.3.95 – Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-64261
Patch Status
Patched
Published
Nov 15, 2025
Affected Software
Appointment Booking Calendar
Researcher
More Details >

Asgaros Forum <= 3.2.1 – Cross-Site Request Forgery to Subscription Settings Update

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-12901
Patch Status
Patched
Published
Nov 11, 2025
Affected Software
Asgaros Forum
Researcher
More Details >

Classified Listing – AI-Powered Classified ads & Business Directory Plugin <= 5.2.0 – Missing Authorization to Authenticated (Subscriber+) Listing Types Tampering

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-12953
Patch Status
Patched
Published
Nov 10, 2025
Affected Software
Classified Listing – AI-Powered Classified ads & Business Directory Plugin
Researcher
More Details >

Contact Form Email <= 1.3.58 – Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-64369
Patch Status
Patched
Published
Nov 15, 2025
Affected Software
Contact Form Email
Researcher
More Details >

Convert WebP & AVIF | Quicq | Best image optimizer and compression plugin | Improve your Google Pagespeed <= 2.0.0 – Missing Authorization to Authenticated (Subscriber+) Afosto Disconnect

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-12015
Patch Status
Unpatched
Published
Nov 12, 2025
Affected Software
Convert WebP & AVIF | Quicq | Best image optimizer and compression plugin | Improve your Google Pagespeed
Researcher
More Details >

CTL Arcade Lite <= 1.0 – Cross-Site Request Forgery to Plugin Activation and Deactivation

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-11886
Patch Status
Unpatched
Published
Nov 10, 2025
Affected Software
CTL Arcade Lite
Researcher
More Details >

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.139 – Missing Authorization to Authenticated (Author+) Arbitrary Image Attachment

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-12833
Patch Status
Patched
Published
Nov 11, 2025
Affected Software
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
Researcher
More Details >

Image Gallery – Photo Grid & Video Gallery <= 2.12.28 – Improper Authorization to Authenticated (Author+) Arbitrary Image File Move

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-12494
Patch Status
Patched
Published
Nov 14, 2025
Affected Software
Image Gallery – Photo Grid & Video Gallery
Researcher
More Details >

Ninja Countdown <= 1.5.0 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Countdown Deletion

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-12665
Patch Status
Unpatched
Published
Nov 10, 2025
Affected Software
Ninja Countdown | Fastest Countdown Builder
Researcher
More Details >

Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.5 – Authenticated (Author+) Insecure Direct Object Reference

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-12366
Patch Status
Patched
Published
Nov 12, 2025
Affected Software
Page Builder: Pagelayer – Drag and Drop website builder
Researcher
More Details >

Plugin Manager <= 1.4.7 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-64271
Patch Status
Patched
Published
Nov 13, 2025
Affected Software
WP Plugin Manager – Deactivate plugins per page
Researcher
More Details >

Private Google Calendars <= 20250811 – Missing Authorization to Authenticated (Subscriber+) Settings Reset

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-12526
Patch Status
Unpatched
Published
Nov 10, 2025
Affected Software
Private Google Calendars
Researcher
More Details >

Qi Blocks <= 1.4.3 – Missing Authorization to Arbitrary Attachment Resize

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-12182
Patch Status
Patched
Published
Nov 14, 2025
Affected Software
Qi Blocks
Researcher
More Details >

Survey Maker <= 5.1.9.4 – Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-64276
Patch Status
Patched
Published
Nov 14, 2025
Affected Software
Survey Maker
Researcher
More Details >

USB Qr Code Scanner For Woocommerce <= 1.0.0 – Cross-Site Request Forgery to Settings Update

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-12588
Patch Status
Unpatched
Published
Nov 10, 2025
Affected Software
USB Qr Code Scanner For Woocommerce
Researcher
More Details >

Wishlist and Save for later for Woocommerce <= 1.1.22 – Insecure Direct Object Reference to Authenticated (Subscriber+) Wishlist Item Deletion

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-12087
Patch Status
Patched
Published
Nov 11, 2025
Affected Software
Wishlist and Save for later for Woocommerce
Researcher
More Details >

WooCommerce PDF Invoice Builder <= 1.2.150 – Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-64269
Patch Status
Patched
Published
Nov 14, 2025
Affected Software
PDF Builder for WooCommerce. Create invoices,packing slips and more
Researcher
More Details >

WP Custom Admin Login Page Logo <= 1.4.8.4 – Cross-Site Request Forgery to Settings Update

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-12132
Patch Status
Unpatched
Published
Nov 10, 2025
Affected Software
WP Custom Admin Login Page Logo
Researcher
More Details >

WP Import – Ultimate CSV XML Importer for WordPress <= 7.33 – Missing Authorization to Authenticated (Author+) Sensitive Information Exposure

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2025-12732
Patch Status
Patched
Published
Nov 11, 2025
Affected Software
WP Import – Ultimate CSV XML Importer for WordPress
Researcher
More Details >

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

The post Wordfence Intelligence Weekly WordPress Vulnerability Report (November 10, 2025 to November 16, 2025) appeared first on Wordfence.

Leave a Comment