Last week, there were 260 vulnerabilities disclosed in 207 WordPress Plugins that have been added to the Wordfence Intelligence Vulnerability Database, and there were 147 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.
Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, and webhook integration are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back.
Enterprises, Hosting Providers, and even Individuals can utilize the vulnerability Database API to receive a complete dump of our database of over 40,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
Total Unpatched & Patched Vulnerabilities Last Week
| Patch Status | Number of Vulnerabilities |
|---|---|
| Patched | 218 |
| Partially Patched | 1 |
| Unpatched | 41 |
Total Vulnerabilities by CVSS Severity Last Week
| Severity Rating | Number of Vulnerabilities |
|---|---|
| Medium Severity | 184 |
| High Severity | 66 |
| Critical Severity | 10 |
Total Vulnerabilities by CWE Type Last Week
| Vulnerability Type by CWE | Number of Vulnerabilities |
|---|---|
| Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) | 66 |
| Missing Authorization | 58 |
| Exposure of Sensitive Information to an Unauthorized Actor | 21 |
| Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) | 18 |
| Improper Privilege Management | 15 |
| Authorization Bypass Through User-Controlled Key | 13 |
| Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) | 11 |
| Deserialization of Untrusted Data | 10 |
| Improper Control of Generation of Code (‘Code Injection’) | 9 |
| Improper Authentication | 6 |
| Unrestricted Upload of File with Dangerous Type | 6 |
| Client-Side Enforcement of Server-Side Security | 5 |
| Cross-Site Request Forgery (CSRF) | 5 |
| Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’) | 3 |
| Insufficient Verification of Data Authenticity | 2 |
| Protection Mechanism Failure | 2 |
| URL Redirection to Untrusted Site (‘Open Redirect’) | 2 |
| Authentication Bypass Using an Alternate Path or Channel | 1 |
| Guessable CAPTCHA | 1 |
| Improper Neutralization of Special Elements in Output Used by a Downstream Component (‘Injection’) | 1 |
| Incorrect Authorization | 1 |
| Missing Authentication for Critical Function | 1 |
| Server-Side Request Forgery (SSRF) | 1 |
| Uncontrolled Resource Consumption | 1 |
| Unverified Password Change | 1 |
Researchers That Contributed to WordPress Security Last Week
| Researcher Name | Number of Vulnerabilities |
|---|---|
| 25 | |
| 10 | |
| 10 | |
| 10 | |
| 6 | |
| 6 | |
| 6 | |
| 5 | |
| 4 | |
| 4 | |
| 4 | |
| 4 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.
WordPress Plugins with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress | acymailing |
| Advanced Contact form 7 DB | advanced-cf7-db |
| Advanced Customized Prompts | advanced-customized-prompts |
| Advanced Partial Payment or Deposit for WooCommerce | advanced-partial-payment-or-deposit-for-woocommerce |
| Advanced Product Fields Extended for WooCommerce | advanced-product-fields-for-woocommerce-extended |
| AI Builder – Generate pages, blocks, images & translate with AI | ai-builder |
| Aruba HiSpeed Cache | aruba-hispeed-cache |
| Awesome Support – WordPress HelpDesk & Support Plugin | awesome-support |
| BackWPup – WordPress Backup & Restore Plugin | backwpup |
| bbPress | bbpress |
| BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server) | woo-bulk-editor |
| Beaver Builder Page Builder – Drag and Drop Website Builder | beaver-builder-lite-version |
| Bold Page Builder | bold-page-builder |
| Bold Timeline Lite | bold-timeline-lite |
| Booking for Appointments and Events Calendar – Amelia | ameliabooking |
| Bookit — Booking & Appointment Calendar | bookit |
| Booktics – Appointment Booking Calendar for Service Businesses | booktics |
| BuddyPress | buddypress |
| Builderall for WordPress | builderall-cheetah-for-wp |
| Bulk Password Reset | bulk-password-reset |
| CatalogX – Catalog Mode, Enquiry & Quotes for WooCommerce | woocommerce-catalog-enquiry |
| Checkout Custom Fields Builder for WooCommerce | checkout-custom-fields-builder-for-woocommerce |
| CODE MONKEYS PROPOSALS – Easily create client proposals from your WordPress admin dashboard | code-monkeys-proposals |
| Contact Form to Chat Apps | Click to Chat to Order – FormyChat | social-contact-form |
| Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress | contact-form-to-db |
| Content Mask | content-mask |
| CoolClock | coolclock |
| CryptoPayment Gateway | cryptopayment-gateway |
| Csomagpontok és Címkék WooCommerce-hez | hungarian-pickup-points-for-woocommerce |
| Custom Menu Wizard Widget | custom-menu-wizard |
| Direct Download for WooCommerce | direct-download-for-woocommerce |
| Domain For Sale – Landing Page Per Domain, Domain Mapping, Offers & Listings | domain-for-sale |
| Drag and Drop File Upload for Elementor Forms | drag-and-drop-file-upload-for-elementor-forms |
| DT LMS – elearning, WordPress LMS Plugin | dt-lms-lite |
| Easy Appointments | easy-appointments |
| Easy Google Fonts | easy-google-fonts |
| EDD Product Catalog Feed by PixelYourSite | edd-products-feed-pro |
| ElasticPress | elasticpress |
| ELEX WooCommerce Request a Quote | elex-request-a-quote |
| Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress | email-subscribers |
| Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar | mage-eventpress |
| Event Tickets and Registration | event-tickets |
| Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce | wp-event-solution |
| EventON – Events Calendar | eventon-lite |
| Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI | everest-forms |
| Featured Image with URL | featured-image-with-url |
| FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment | firebox |
| Flexible Quantity – Measurement Price Calculator for WooCommerce | flexible-quantity-measurement-price-calculator-for-woocommerce |
| Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty | chaty |
| Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder | form-maker |
| Frontegg SAML SSO | frontegg-saml-sso |
| GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI | gamipress |
| Gato GraphQL | gatographql |
| GEO my WP | geo-my-wp |
| Gpx2Graphics | gpx2graphics |
| Graphina – Charts and Graphs For Elementor | graphina-elementor-charts-and-graphs |
| Groundhogg — CRM, Newsletters, and Marketing Automation | groundhogg |
| Gutenverse News – News Blocks for Blog & Magazine Sites | gutenverse-news |
| Hide My WP Ghost – Security & Firewall | hide-my-wp |
| HT Menu – WordPress Mega Menu Builder for Elementor | ht-menu-lite |
| HUSKY – Products Filter for WooCommerce Professional | woocommerce-products-filter |
| Hustle – Email Marketing, Lead Generation, Optins, Popups | wordpress-popup |
| ilGhera Reviso Exporter for WooCommerce | wc-exporter-for-reviso |
| IMPress for IDX Broker | idx-broker-platinum |
| Insert or Embed Articulate Content into WordPress | insert-or-embed-articulate-content-into-wordpress |
| IP2Location Country Blocker | ip2location-country-blocker |
| IPGP Visitors Origin | ipgp-visitors-origin |
| JCH Optimize | jch-optimize |
| JetFormBuilder — Dynamic Blocks Form Builder | jetformbuilder |
| Jetpack – WP Security, Backup, Speed, & Growth | jetpack |
| Kirki – Freeform Page Builder, Website Builder & Customizer | kirki |
| LearnPress – WordPress LMS Plugin for Create and Sell Online Courses | learnpress |
| Live Composer – Free WordPress Website Builder | live-composer-page-builder |
| Loops & Logic | tangible-loops-and-logic |
| LukasApps CAPTCHA tools for Contact Form 7 | contact-form-7-simple-recaptcha |
| Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance | mail-mint |
| MailMunch – Grow your Email List | mailmunch |
| Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits | master-addons |
| Masteriyo LMS – LMS Course Builder, Quizzes & Certificates | learning-management-system |
| MDJM Event Management | mobile-dj-manager |
| Media Library Assistant | media-library-assistant |
| MemberPress Corporate Accounts | memberpress-corporate |
| MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor | metform |
| miniOrange 2FA – Two Factor Authentication for WordPress (OTP, SMS, Email, Google Authenticator) | miniorange-2-factor-authentication |
| MIPL Checkout Fields Manager for WooCommerce – Customize, Organize & Group Checkout Fields. | mipl-wc-checkout-fields |
| Mobile Events Manager | mobile-events-manager |
| MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO | multiple-pages-generator-by-porthas |
| MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions | dc-woocommerce-multi-vendor |
| Music Store – WordPress eCommerce | music-store |
| My Calendar – Accessible Event Manager | my-calendar |
| Nexi XPay Build | nexi-xpay-build |
| Next-Cart Store to WooCommerce Migration | nextcart-woocommerce-migration |
| Ninja Forms – The Contact Form Builder That Grows With You | ninja-forms |
| Notiqoo – Order Notification & Customer Chat for WooCommerce | wc-messaging |
| Online Scheduling and Appointment Booking System – Bookly | bookly-responsive-appointment-booking-tool |
| Open User Map – Interactive Leaflet Maps | open-user-map |
| Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More | themeisle-companion |
| OTP Login & Register Woocommerce | mobile-login-woocommerce |
| Page Visits Counter – Lite | page-visits-counter-lite |
| Passster – Password Protect Pages and Content | content-protector |
| Payment Gateway PayPay for WooCommerce | wc-paypay-gateway |
| Payment Plugins for PayPal WooCommerce | pymntpl-paypal-woocommerce |
| Payment Plugins for Stripe WooCommerce | woo-stripe-payment |
| PDF Builder for WooCommerce. Create invoices,packing slips and more | woo-pdf-invoice-builder |
| Podlove Podcast Publisher | podlove-podcasting-plugin-for-wordpress |
| Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred | mycred |
| Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) | buddyforms |
| Product Filter for WooCommerce by WBW | woo-product-filter |
| Product XML Feed Manager for WooCommerce – Google Shopping, Social Sites, Skroutz & More | product-xml-feeds-for-woocommerce |
| PublishPress Capabilities: User Role Access Control, Admin Area Permissions | capability-manager-enhanced |
| Quads Ads Manager for Google AdSense | quick-adsense-reloaded |
| Quentn WP | quentn-wp |
| Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker | quiz-master-next |
| Rara One Click Demo Import | rara-one-click-demo-import |
| Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) | really-simple-ssl |
| Redux Framework | redux-framework |
| Registration Form for WooCommerce | registration-form-for-woocommerce |
| Relevanssi – A Better Search | relevanssi |
| RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress | computer-repair-shop |
| Repeater Fields for Gravity Forms | repeater-for-gravity-forms |
| Return Refund and Exchange For WooCommerce | woo-refund-and-exchange-lite |
| Robokassa payment gateway for Woocommerce | robokassa |
| Rox Appointment Booking – Appointment Booking Scheduling Solution | rox-appointment-booking |
| Royal Addons for Elementor – Addons and Templates Kit for Elementor | royal-elementor-addons |
| rtMedia for WordPress, BuddyPress and bbPress | buddypress-media |
| RTMKit | rometheme-for-elementor |
| Salon Booking System – Appointment Booking for Salons, Barbershops & Spas | salon-booking-system |
| SEO Flow by LupsOnline | lupsonline-link-netwerk |
| Shirt Product Designer for WooCommerce | woo-shirt-product-designer |
| Shopping Cart & eCommerce Store | wp-easycart |
| Sidebar Manager Light | sidebar-manager-light |
| Simple Ajax Chat – Add a Fast, Secure Chat Box | simple-ajax-chat |
| Simple CAPTCHA with Cloudflare Turnstile | simple-cloudflare-turnstile |
| Simple Membership | simple-membership |
| Simple Payment | simple-payment |
| Sina Extension for Elementor | sina-extension-for-elementor |
| Site Kit by Google – Analytics, Search Console, AdSense, Speed | google-site-kit |
| Site Reviews | site-reviews |
| SiteSkite MCP AI – Connector for Claude, ChatGPT, Cursor & WordPress WebOps | siteskite |
| Sky Addons for Elementor | sky-elementor-addons |
| Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated | slim-seo |
| Smart Marketing SMS and Newsletters Forms | smart-marketing-for-wp |
| SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery | sms-alert |
| Spam protection, Honeypot, Anti-Spam by CleanTalk | cleantalk-spam-protect |
| Sprout Invoices – Client Invoicing & Estimates | sprout-invoices |
| SSL Zen — SSL Certificate Installer & HTTPS Redirects | ssl-zen |
| Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg | astra-sites |
| Sticky Chat Widget – Floating Chat Icons, Contact Form, Call, Click to Chat, Email & Message Buttons | sticky-chat-widget |
| Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers | sunshine-photo-cart |
| SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent | supportcandy |
| SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments | surecart |
| SureRank SEO – Meta Tags, Social Preview, XML Sitemap, Schema & Open Graph | surerank |
| Teddy Bear Customize Addon | teddy-bear-customize-addon |
| Temporary Login Without Password | temporary-login-without-password |
| Thanko Thank You Page Customizer for WooCommerce – Increase Your Sales | woo-thank-you-page-customizer |
| The Events Calendar | the-events-calendar |
| ThemeREX Addons | trx_addons |
| Themify – WooCommerce Product Filter | themify-wc-product-filter |
| Translate WordPress with GTranslate | gtranslate |
| Tutor LMS – eLearning and online course solution | tutor |
| Ultimate Gift Cards for WooCommerce | woo-gift-cards-lite |
| Unbounce Landing Pages | unbounce |
| Unlimited Elements For Elementor | unlimited-elements-for-elementor |
| User Access Manager | user-access-manager |
| User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder | user-registration |
| UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP | userswp |
| Verified Reviews (Avis Vérifiés) | netreviews |
| Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner… | vigilante |
| Visual Composer Website Builder | visualcomposer |
| Visualizer – Tables & Charts Manager with Built-in AI Generator | visualizer |
| WebTotem Backups | wt-backups |
| Wise Chat | wise-chat |
| WooCommerce | woocommerce |
| WP BackItUp Community Edition | wp-backitup |
| WP Compress – Instant Performance & Speed Optimization | wp-compress-image-optimizer |
| WP Crowdfunding | wp-crowdfunding |
| WP Directory Kit | wpdirectorykit |
| WP Docs | wp-docs |
| WP Express Checkout (Fast Payments via PayPal & Stripe) | wp-express-checkout |
| WP Fast Total Search – The Power of Indexed Search | fulltext-search |
| WP Fusion (Pro) | wp-fusion |
| WP Highlight Box | wp-highlight-box |
| WP Module Data | wp-module-data |
| WP Photo Album Plus | wp-photo-album-plus |
| WP Plugin Bluehost | bluehost-wordpress-plugin |
| WP Plugin Crazy Domains | wp-plugin-crazy-domains |
| WP Plugin Hostgator | wp-plugin-hostgator |
| WP Plugin Web | wp-plugin-web |
| WP Recipe Maker | wp-recipe-maker |
| WP Travel – Ultimate Travel Booking System, Tour Management Engine | wp-travel |
| WP-Members Membership Plugin | wp-members |
| WP-Stateless – Google Cloud Storage | wp-stateless |
| WPAdverts – Classifieds Plugin | wpadverts |
| WPBot – AI ChatBot for Live Support, Lead Generation, WordPress Automation, AI Services | chatbot |
| WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System | wp-cafe |
| WPCS – WordPress Currency Switcher Professional | currency-switcher |
| WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell | wpfunnels |
| WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode | gdpr-cookie-consent |
| WPML Multilingual CMS | sitepress-multilingual-cms |
| WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping | wp-product-feed-manager |
| YITH WooCommerce Waitlist Premium | yith-woocommerce-waiting-list-premium |
| YITH WooCommerce Wishlist | yith-woocommerce-wishlist |
| Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress | youzify |
| Zephyr Project Manager | zephyr-project-manager |
| ZHBackup – Backup, Restore & Migration | zhbackup |
| zipMoney(Zip Co) Payments Plugin for WooCommerce | zipmoney-payments-woocommerce |
| المنتور فارسی | persian-elementor |
Vulnerability Details
Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.
Advanced Customized Prompts <= 1.0.1 – Unauthenticated Privilege Escalation via Account Takeover
9.8
Affected Software
Advanced Customized Prompts [advanced-customized-prompts]
Researcher
Affected Software
Drag and Drop File Upload for Elementor Forms [drag-and-drop-file-upload-for-elementor-forms]
Researcher
Affected Software
Frontegg SAML SSO [frontegg-saml-sso]
Researcher
Affected Software
MIPL Checkout Fields Manager for WooCommerce – Customize, Organize & Group Checkout Fields. [mipl-wc-checkout-fields]
Researcher
Affected Software
Teddy Bear Customize Addon [teddy-bear-customize-addon]
Researcher
Affected Software
Teddy Bear Customize Addon [teddy-bear-customize-addon]
Researcher
Affected Software
The Events Calendar [the-events-calendar]
Researchers
Affected Software
The Events Calendar [the-events-calendar]
Researchers
Advanced Product Fields Extended for WooCommerce <= 3.1.6 – Unauthenticated Arbitrary File Deletion
9.1
Affected Software
Advanced Product Fields Extended for WooCommerce [advanced-product-fields-for-woocommerce-extended]
Researcher
Affected Software
CryptoPayment Gateway [cryptopayment-gateway]
Researcher
Affected Software
Researcher
Affected Software
Gpx2Graphics [gpx2graphics]
Researcher
Affected Software
Insert or Embed Articulate Content into WordPress [insert-or-embed-articulate-content-into-wordpress]
Researcher
Affected Software
Live Composer – Free WordPress Website Builder [live-composer-page-builder]
Researcher
Affected Software
MemberPress Corporate Accounts [memberpress-corporate]
Researcher
Affected Software
RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress [computer-repair-shop]
Researcher
Affected Software
Researcher
Affected Software
Researchers
Affected Software
WP Module Data [wp-module-data]
WP Plugin Bluehost [bluehost-wordpress-plugin]
WP Plugin Crazy Domains [wp-plugin-crazy-domains]
WP Plugin Hostgator [wp-plugin-hostgator]
WP Plugin Web [wp-plugin-web]
Researcher
Affected Software
YITH WooCommerce Waitlist Premium [yith-woocommerce-waiting-list-premium]
Researcher
Affected Software
CODE MONKEYS PROPOSALS – Easily create client proposals from your WordPress admin dashboard [code-monkeys-proposals]
Researcher
Affected Software
Researcher
Affected Software
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates [learning-management-system]
Researcher
Affected Software
Next-Cart Store to WooCommerce Migration [nextcart-woocommerce-migration]
Researcher
Affected Software
Site Reviews [site-reviews]
Researcher
Affected Software
ThemeREX Addons [trx_addons]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
WebTotem Backups [wt-backups]
Researcher
Affected Software
Bulk Password Reset [bulk-password-reset]
Affected Software
Researcher
Affected Software
Direct Download for WooCommerce [direct-download-for-woocommerce]
Researcher
Affected Software
ELEX WooCommerce Request a Quote [elex-request-a-quote]
Researcher
Affected Software
Event Tickets and Registration [event-tickets]
Researcher
Eventin <= 4.1.22 – Authenticated (Contirbutor+) Local File Inclusion via ‘event_layout’ Parameter
7.5
Affected Software
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution]
Researcher
Affected Software
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution]
Researcher
Affected Software
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates [learning-management-system]
Researcher
Affected Software
Music Store – WordPress eCommerce [music-store]
Researcher
Affected Software
Quentn WP [quentn-wp]
Researcher
Affected Software
rtMedia for WordPress, BuddyPress and bbPress [buddypress-media]
Researcher
Affected Software
Researcher
Affected Software
Unlimited Elements For Elementor [unlimited-elements-for-elementor]
Researcher
Affected Software
Verified Reviews (Avis Vérifiés) [netreviews]
Researchers
Affected Software
WooCommerce [woocommerce]
Researcher
Affected Software
WP Fusion (Pro) [wp-fusion]
Researcher
Affected Software
CatalogX – Catalog Mode, Enquiry & Quotes for WooCommerce [woocommerce-catalog-enquiry]
Researcher
Affected Software
miniOrange 2FA – Two Factor Authentication for WordPress (OTP, SMS, Email, Google Authenticator) [miniorange-2-factor-authentication]
Researcher
Affected Software
SEO Flow by LupsOnline [lupsonline-link-netwerk]
Researcher
Affected Software
Researcher
Affected Software
Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress [contact-form-to-db]
Researcher
Affected Software
Researcher
Affected Software
Easy Appointments [easy-appointments]
Researcher
Affected Software
Gutenverse News – News Blocks for Blog & Magazine Sites [gutenverse-news]
Researcher
Affected Software
Hide My WP Ghost – Security & Firewall [hide-my-wp]
Researcher
Affected Software
JetFormBuilder — Dynamic Blocks Form Builder [jetformbuilder]
Researcher
Patch Status
Patched
Patched
Published
Sep 8, 2026
Sep 8, 2026
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Open User Map – Interactive Leaflet Maps <= 1.4.50 – Unauthenticated Stored Cross-Site Scripting
7.2
Affected Software
Open User Map – Interactive Leaflet Maps [open-user-map]
Researcher
Affected Software
Page Visits Counter – Lite [page-visits-counter-lite]
Researcher
Affected Software
PublishPress Capabilities: User Role Access Control, Admin Area Permissions [capability-manager-enhanced]
Researcher
Affected Software
Rara One Click Demo Import [rara-one-click-demo-import]
Researcher
Affected Software
Repeater Fields for Gravity Forms [repeater-for-gravity-forms]
Researcher
Affected Software
Shopping Cart & eCommerce Store [wp-easycart]
Researcher
Affected Software
Sidebar Manager Light [sidebar-manager-light]
Researcher
Affected Software
Simple Ajax Chat – Add a Fast, Secure Chat Box [simple-ajax-chat]
Researcher
Affected Software
Unlimited Elements For Elementor [unlimited-elements-for-elementor]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
WP Photo Album Plus [wp-photo-album-plus]
Researcher
Affected Software
WPAdverts – Classifieds Plugin [wpadverts]
Researcher
Affected Software
Researcher
Affected Software
WPCS – WordPress Currency Switcher Professional [currency-switcher]
Researcher
Affected Software
EDD Product Catalog Feed by PixelYourSite [edd-products-feed-pro]
Researcher
Affected Software
Researcher
Affected Software
Beaver Builder Page Builder – Drag and Drop Website Builder [beaver-builder-lite-version]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Hustle – Email Marketing, Lead Generation, Optins, Popups [wordpress-popup]
Researcher
Affected Software
LukasApps CAPTCHA tools for Contact Form 7 [contact-form-7-simple-recaptcha]
Researcher
Affected Software
MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO [multiple-pages-generator-by-porthas]
Researchers
Simple CAPTCHA with Cloudflare Turnstile <= 1.42.1 – Unauthenticated Arbitrary Shortcode Execution
6.5
Affected Software
Simple CAPTCHA with Cloudflare Turnstile [simple-cloudflare-turnstile]
Researcher
Affected Software
Smart Marketing SMS and Newsletters Forms [smart-marketing-for-wp]
Researcher
Affected Software
Spam protection, Honeypot, Anti-Spam by CleanTalk [cleantalk-spam-protect]
Researcher
Affected Software
PDF Builder for WooCommerce. Create invoices,packing slips and more [woo-pdf-invoice-builder]
Researcher
Affected Software
WPML Multilingual CMS [sitepress-multilingual-cms]
Researcher
Affected Software
WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping [wp-product-feed-manager]
Researcher
Affected Software
Researcher
Affected Software
Advanced Customized Prompts [advanced-customized-prompts]
Researcher
Affected Software
Researcher
Affected Software
Aruba HiSpeed Cache [aruba-hispeed-cache]
Researcher
Affected Software
Bold Page Builder [bold-page-builder]
Researcher
Affected Software
Bold Timeline Lite [bold-timeline-lite]
Researcher
Affected Software
Booking for Appointments and Events Calendar – Amelia [ameliabooking]
Researcher
Affected Software
Builderall for WordPress [builderall-cheetah-for-wp]
Researcher
Affected Software
Builderall for WordPress [builderall-cheetah-for-wp]
Researcher
Affected Software
Content Mask [content-mask]
Researcher
Affected Software
CoolClock [coolclock]
Researcher
Affected Software
CoolClock [coolclock]
Researcher
Affected Software
Custom Menu Wizard Widget [custom-menu-wizard]
Researcher
Affected Software
Easy Google Fonts [easy-google-fonts]
Researcher
Affected Software
EventON – Events Calendar [eventon-lite]
Researcher
Affected Software
Featured Image with URL [featured-image-with-url]
Researcher
Affected Software
Graphina – Charts and Graphs For Elementor [graphina-elementor-charts-and-graphs]
Affected Software
HT Menu – WordPress Mega Menu Builder for Elementor [ht-menu-lite]
Researcher
Affected Software
JCH Optimize [jch-optimize]
Researcher
Affected Software
Researchers
Affected Software
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates [learning-management-system]
Researcher
Affected Software
Media Library Assistant [media-library-assistant]
Researcher
Affected Software
Media Library Assistant [media-library-assistant]
Researcher
Affected Software
Media Library Assistant [media-library-assistant]
Researcher
Affected Software
My Calendar – Accessible Event Manager [my-calendar]
Researcher
Affected Software
My Calendar – Accessible Event Manager [my-calendar]
Researcher
Affected Software
Researcher
Affected Software
Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More [themeisle-companion]
Researcher
Affected Software
Podlove Podcast Publisher [podlove-podcasting-plugin-for-wordpress]
Researcher
Affected Software
Redux Framework [redux-framework]
Researcher
Affected Software
Simple Payment [simple-payment]
Researcher
Affected Software
Sina Extension for Elementor [sina-extension-for-elementor]
Researcher
Affected Software
Visual Composer Website Builder [visualcomposer]
Researcher
Affected Software
WP Crowdfunding [wp-crowdfunding]
Researcher
Affected Software
WP Highlight Box [wp-highlight-box]
Researchers
Affected Software
Zephyr Project Manager [zephyr-project-manager]
Researcher
Affected Software
Gato GraphQL [gatographql]
Researcher
Affected Software
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions [dc-woocommerce-multi-vendor]
Researcher
Registration Form for WooCommerce 1.1.0 – 1.1.2 – Authenticated (Contributor+) Privilege Escalation
6.3
Affected Software
Registration Form for WooCommerce [registration-form-for-woocommerce]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
HUSKY – Products Filter for WooCommerce Professional [woocommerce-products-filter]
Researcher
Affected Software
IPGP Visitors Origin [ipgp-visitors-origin]
Researcher
Affected Software
Product Filter for WooCommerce by WBW [woo-product-filter]
Researcher
Affected Software
Relevanssi – A Better Search [relevanssi]
Researcher
Simple CAPTCHA with Cloudflare Turnstile <= 1.42.1 – Unauthenticated Arbitrary Shortcode Execution
6.1
Affected Software
Simple CAPTCHA with Cloudflare Turnstile [simple-cloudflare-turnstile]
Researcher
Affected Software
Themify – WooCommerce Product Filter [themify-wc-product-filter]
Researcher
Affected Software
Unlimited Elements For Elementor [unlimited-elements-for-elementor]
Researcher
User Access Manager <= 2.3.18 – Reflected Cross-Site Scripting via ‘tab_group_section’ Parameter
6.1
Affected Software
User Access Manager [user-access-manager]
Researcher
Affected Software
WP-Members Membership Plugin [wp-members]
Researcher
Affected Software
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution]
Researcher
Affected Software
Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool]
Researcher
Affected Software
Advanced Partial Payment or Deposit for WooCommerce [advanced-partial-payment-or-deposit-for-woocommerce]
Researcher
Affected Software
bbPress [bbpress]
Researcher
Booking for Appointments and Events Calendar – Amelia 9.0 – 9.8.0 – Unauthenticated Payment Bypass
5.3
Affected Software
Booking for Appointments and Events Calendar – Amelia [ameliabooking]
Researcher
Affected Software
Researcher
Booktics – Appointment Booking Calendar for Service Businesses <= 1.0.24 – Missing Authorization
5.3
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Csomagpontok és Címkék WooCommerce-hez [hungarian-pickup-points-for-woocommerce]
Researcher
Affected Software
WP Directory Kit [wpdirectorykit]
Researcher
Affected Software
Researcher
Affected Software
DT LMS – elearning, WordPress LMS Plugin [dt-lms-lite]
Researcher
Affected Software
ElasticPress [elasticpress]
Researcher
Affected Software
Researcher
Affected Software
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution]
Researcher
Affected Software
WP Express Checkout (Fast Payments via PayPal & Stripe) [wp-express-checkout]
Researcher
Flexible Quantity – Measurement Price Calculator for WooCommerce <= 2.3.21 – Missing Authorization
5.3
Affected Software
Flexible Quantity – Measurement Price Calculator for WooCommerce [flexible-quantity-measurement-price-calculator-for-woocommerce]
Researcher
Affected Software
IMPress for IDX Broker [idx-broker-platinum]
Researcher
Affected Software
IP2Location Country Blocker [ip2location-country-blocker]
Researcher
Affected Software
JetFormBuilder — Dynamic Blocks Form Builder [jetformbuilder]
Researcher
Affected Software
Researcher
Affected Software
Loops & Logic [tangible-loops-and-logic]
Researcher
Affected Software
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates [learning-management-system]
Researcher
Affected Software
Researcher
Affected Software
miniOrange 2FA – Two Factor Authentication for WordPress (OTP, SMS, Email, Google Authenticator) [miniorange-2-factor-authentication]
Researcher
Affected Software
MDJM Event Management [mobile-dj-manager]
Mobile Events Manager [mobile-events-manager]
Researchers
Affected Software
Nexi XPay Build [nexi-xpay-build]
Researcher
OTP Login & Register Woocommerce <= 2.7.2 – Unauthenticated Authentication Bypass via Brute Force
5.3
Affected Software
OTP Login & Register Woocommerce [mobile-login-woocommerce]
Researcher
Affected Software
Passster – Password Protect Pages and Content [content-protector]
Researcher
Affected Software
Payment Gateway PayPay for WooCommerce [wc-paypay-gateway]
Researcher
Affected Software
Payment Plugins for PayPal WooCommerce [pymntpl-paypal-woocommerce]
Researcher
Affected Software
Payment Plugins for Stripe WooCommerce [woo-stripe-payment]
Researcher
Affected Software
Researcher
Affected Software
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker [quiz-master-next]
Researcher
Affected Software
Researcher
Affected Software
Return Refund and Exchange For WooCommerce [woo-refund-and-exchange-lite]
Researcher
Affected Software
Robokassa payment gateway for Woocommerce [robokassa]
Researcher
Affected Software
Rox Appointment Booking – Appointment Booking Scheduling Solution [rox-appointment-booking]
Researcher
Affected Software
Rox Appointment Booking – Appointment Booking Scheduling Solution [rox-appointment-booking]
Researcher
Affected Software
Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons]
Researcher
Affected Software
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas [salon-booking-system]
Researcher
Affected Software
Shirt Product Designer for WooCommerce [woo-shirt-product-designer]
Researcher
Affected Software
Simple CAPTCHA with Cloudflare Turnstile [simple-cloudflare-turnstile]
Researcher
Affected Software
Contact Form to Chat Apps | Click to Chat to Order – FormyChat [social-contact-form]
Researcher
Affected Software
Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers [sunshine-photo-cart]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Teddy Bear Customize Addon [teddy-bear-customize-addon]
Researcher
Affected Software
Thanko Thank You Page Customizer for WooCommerce – Increase Your Sales [woo-thank-you-page-customizer]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Ultimate Gift Cards for WooCommerce < 3.2.10 – Unauthenticated Inflated Gift Card Credit Acquisition
5.3
Affected Software
Ultimate Gift Cards for WooCommerce [woo-gift-cards-lite]
Researcher
Affected Software
Ultimate Gift Cards for WooCommerce [woo-gift-cards-lite]
Researcher
Affected Software
Researcher
Patch Status
Patched
Patched
Published
Sep 8, 2026
Sep 8, 2026
Affected Software
WP Compress – Instant Performance & Speed Optimization [wp-compress-image-optimizer]
Researcher
Affected Software
WP Fast Total Search – The Power of Indexed Search [fulltext-search]
Researcher
WP Travel – Ultimate Travel Booking System, Tour Management Engine <= 12.0.3 – Missing Authorization
5.3
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
YITH WooCommerce Wishlist [yith-woocommerce-wishlist]
Researcher
Affected Software
ZHBackup – Backup, Restore & Migration [zhbackup]
Researcher
Affected Software
zipMoney(Zip Co) Payments Plugin for WooCommerce [zipmoney-payments-woocommerce]
Researcher
Affected Software
المنتور فارسی [persian-elementor]
Researcher
Affected Software
Booking for Appointments and Events Calendar – Amelia [ameliabooking]
Researcher
Affected Software
WP Directory Kit [wpdirectorykit]
Researcher
Affected Software
Researcher
Affected Software
Quentn WP [quentn-wp]
Researcher
Affected Software
Sky Addons for Elementor [sky-elementor-addons]
Researcher
Affected Software
WP BackItUp Community Edition [wp-backitup]
Researcher
WP Crowdfunding <= 2.2.1 – Authenticated (Shop Manager+) SQL Injection via ‘wpneo_reward’ Post Meta
4.9
Affected Software
WP Crowdfunding [wp-crowdfunding]
Researcher
Temporary Login Without Password 1.5 – 1.9.8 – Authenticated (Administrator+) Privilege Escalation
4.7
Affected Software
Temporary Login Without Password [temporary-login-without-password]
Researcher
Affected Software
Translate WordPress with GTranslate [gtranslate]
Researcher
Affected Software
Advanced Contact form 7 DB [advanced-cf7-db]
Researcher
Affected Software
Advanced Customized Prompts [advanced-customized-prompts]
Researcher
Affected Software
Awesome Support – WordPress HelpDesk & Support Plugin [awesome-support]
Researcher
Affected Software
BackWPup – WordPress Backup & Restore Plugin [backwpup]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
BuddyPress [buddypress]
Researcher
Affected Software
Builderall for WordPress [builderall-cheetah-for-wp]
Researcher
Affected Software
Checkout Custom Fields Builder for WooCommerce [checkout-custom-fields-builder-for-woocommerce]
Researcher
Affected Software
WP Directory Kit [wpdirectorykit]
Researcher
Affected Software
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution]
Researcher
Affected Software
ilGhera Reviso Exporter for WooCommerce [wc-exporter-for-reviso]
Researcher
Affected Software
IMPress for IDX Broker [idx-broker-platinum]
Researcher
Affected Software
MailMunch – Grow your Email List [mailmunch]
Researcher
Affected Software
Researcher
Affected Software
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates [learning-management-system]
Researcher
Affected Software
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates [learning-management-system]
Researcher
Affected Software
Notiqoo – Order Notification & Customer Chat for WooCommerce [wc-messaging]
Researcher
Affected Software
Payment Plugins for PayPal WooCommerce [pymntpl-paypal-woocommerce]
Affected Software
Product XML Feed Manager for WooCommerce – Google Shopping, Social Sites, Skroutz & More [product-xml-feeds-for-woocommerce]
Researcher
Affected Software
Quads Ads Manager for Google AdSense [quick-adsense-reloaded]
Researcher
Affected Software
rtMedia for WordPress, BuddyPress and bbPress [buddypress-media]
Researcher
Affected Software
RTMKit [rometheme-for-elementor]
Researcher
Affected Software
Simple Membership [simple-membership]
Researcher
Affected Software
Site Kit by Google – Analytics, Search Console, AdSense, Speed [google-site-kit]
Researcher
Affected Software
Researcher
Affected Software
Sprout Invoices – Client Invoicing & Estimates [sprout-invoices]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Temporary Login Without Password [temporary-login-without-password]
Researcher
Affected Software
Ultimate Gift Cards for WooCommerce [woo-gift-cards-lite]
Researcher
Affected Software
Unbounce Landing Pages [unbounce]
Researcher
Affected Software
Researcher
Affected Software
WP Recipe Maker [wp-recipe-maker]
Researcher
Affected Software
WP-Stateless – Google Cloud Storage [wp-stateless]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.
This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
The post Wordfence Intelligence Weekly WordPress Vulnerability Report (September 7, 2026 to September 13, 2026) appeared first on Wordfence.
