Last week, there were 240 vulnerabilities disclosed in 184 WordPress Plugins and 17 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 105 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.
Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back.
Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 35,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
New Firewall Rules Deployed Last Week
The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.
The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:
- WAF-RULE-952 – Data redacted while we work with the vendor on a patch.
Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.
Total Unpatched & Patched Vulnerabilities Last Week
| Patch Status | Number of Vulnerabilities |
|---|---|
| Patched | 166 |
| Unpatched | 74 |
Total Vulnerabilities by CVSS Severity Last Week
| Severity Rating | Number of Vulnerabilities |
|---|---|
| Medium Severity | 111 |
| High Severity | 112 |
| Critical Severity | 17 |
Total Vulnerabilities by CWE Type Last Week
| Vulnerability Type by CWE | Number of Vulnerabilities |
|---|---|
| Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) | 73 |
| Missing Authorization | 42 |
| Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) | 27 |
| Deserialization of Untrusted Data | 14 |
| Improper Privilege Management | 12 |
| Authorization Bypass Through User-Controlled Key | 11 |
| Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’) | 11 |
| Exposure of Sensitive Information to an Unauthorized Actor | 10 |
| Unrestricted Upload of File with Dangerous Type | 10 |
| Improper Control of Generation of Code (‘Code Injection’) | 8 |
| Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) | 5 |
| Cross-Site Request Forgery (CSRF) | 3 |
| Improper Authentication | 3 |
| Client-Side Enforcement of Server-Side Security | 2 |
| Server-Side Request Forgery (SSRF) | 2 |
| Unverified Password Change | 2 |
| Improper Authorization | 1 |
| Improper Input Validation | 1 |
| Incorrect Authorization | 1 |
| Incorrect Privilege Assignment | 1 |
| Weak Password Recovery Mechanism for Forgotten Password | 1 |
Researchers That Contributed to WordPress Security Last Week
| Researcher Name | Number of Vulnerabilities |
|---|---|
| 19 | |
| 17 | |
| 16 | |
| 12 | |
| 10 | |
| 9 | |
| 8 | |
| 6 | |
| 6 | |
| 5 | |
| 5 | |
| 5 | |
| 4 | |
| 4 | |
| 4 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.
WordPress Plugins with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| 10Web Booster – Website speed optimization, Cache & Page Speed optimizer | tenweb-speed-optimizer |
| 12 Step Meeting List | 12-step-meeting-list |
| Abandoned Cart Pro for WooCommerce | woocommerce-abandon-cart-pro |
| Admin and Site Enhancements (ASE) | admin-site-enhancements |
| Advance Product Search- Voice & Ajax Search for WooCommerce | th-advance-product-search |
| Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution | file-manager-advanced |
| Advanced Product Fields (Product Addons) for WooCommerce | advanced-product-fields-for-woocommerce |
| Affiliates Manager | affiliates-manager |
| AI Agent by SiteGround | sg-ai-studio |
| All-in-One WP Migration and Backup | all-in-one-wp-migration |
| Appointment Hour Booking – Booking Calendar | appointment-hour-booking |
| Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback | atarim-visual-collaboration |
| Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code | automation-web-platform |
| AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress | automatorwp |
| Autopay | platnosci-online-blue-media |
| B2Bking | b2bking |
| B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More | b2bking-wholesale-for-woocommerce |
| BBQ Pro | bbq-pro |
| Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots | bp-better-messages |
| Booking calendar, Appointment Booking System | booking-calendar |
| BookingPress Appointment Booking Pro | bookingpress-appointment-booking-pro |
| Broken Link Checker | broken-link-checker |
| CatFolders Document Gallery & PDF Library | catfolders-document-gallery |
| Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) | charitable |
| Community by PeepSo – Download from PeepSo.com | peepso-core |
| Contact Form by Supsystic | contact-form-by-supsystic |
| Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe | contest-gallery |
| Depicter — Popup & Slider Builder | depicter |
| Digits: WordPress Mobile Number Signup and Login | digits |
| Dinatur | dinatur |
| Directory Pro | directory-pro |
| Draft List | simple-draft-list |
| Duitku Payment Gateway | duitku-social-payment-gateway |
| DynamicKit for Elementor | dynamickit-elementor |
| E-cab Taxi Booking Manager for Woocommerce | ecab-taxi-booking-manager |
| Easy Appointments | easy-appointments |
| Easy Elementor Addons – Addons Pack for Elementor Page Builder | easy-elementor-addons |
| Easy Media Replace | easy-media-replace |
| EasyTest – Simplify A/B Testing | convertpro |
| ECS – Ele Custom Skin for Elementor | ele-custom-skin |
| Elementor Website Builder Pro | elementor-pro |
| EPROLO-Dropshipping | eprolo-dropshipping |
| eShipper Commerce | eshipper-commerce |
| Estatik Real Estate Plugin | estatik |
| Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce | wp-event-solution |
| Events Made Easy | events-made-easy |
| EWWW Image Optimizer | ewww-image-optimizer |
| Extra Product Options Builder for WooCommerce | additional-product-fields-for-woocommerce |
| Featured Video Plus | featured-video-plus |
| Flatastic – Versatile MultiVendor WordPress Theme | flatastic |
| Flexible Subscriptions | flexible-subscriptions |
| Fluent Forms Pro Add On Pack | fluentformpro |
| Flutterwave WooCommerce | rave-woocommerce-payment-gateway |
| Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder | form-maker |
| Forminator Forms – Contact Form, Payment Form & Custom Form Builder | forminator |
| Frontend Admin by DynamiApps | acf-frontend-form-element |
| FundEngine – Donation and Crowdfunding Platform | wp-fundraising-donation |
| GEO Plugin by Squirrly SEO | squirrly-seo |
| GeoDirectory – WP Business Directory Plugin and Classified Listings Directory | geodirectory |
| Global Gallery – WordPress Responsive Gallery | global-gallery |
| Golo Framework | golo-framework |
| GP Premium | gp-premium |
| Greenshift – animation and page builder blocks | greenshift-animation-and-page-builder-blocks |
| GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor | gutenkit-blocks-addon |
| HashBar – Announcement, Notification Bar & Popup Campaign | hashbar-wp-notification-bar |
| Image Photo Gallery Final Tiles Grid | final-tiles-grid-gallery-lite |
| InfiniteWP Client | iwp-client |
| Issues and Series for Newspapers, Magazines, Publishers, Writers | organize-series |
| JetAppointment | jet-appointments-booking |
| JetEngine | jet-engine |
| JSON Options | json-options |
| Kalles Addons | kalles-addons |
| Kirki – Freeform Page Builder, Website Builder & Customizer | kirki |
| KiviCare – Clinic & Patient Management System (EHR) | kivicare-clinic-management-system |
| kk Star Ratings – Rate Post & Collect User Feedbacks | kk-star-ratings |
| Leyka | leyka |
| License Manager for WooCommerce | license-manager-for-woocommerce |
| Locatoraid Store Locator | locatoraid |
| Login With Ajax – Fast Logins, 2FA, Redirects | login-with-ajax |
| Mailgun for WordPress | mailgun |
| Manual Image Crop | manual-image-crop |
| Masteriyo LMS – LMS Course Builder, Quizzes & Certificates | learning-management-system |
| MasterStudy LMS WordPress Plugin – for Online Courses and Education | masterstudy-lms-learning-management-system |
| MC4WP: Mailchimp for WordPress | mailchimp-for-wp |
| Media Library Assistant | media-library-assistant |
| Membership For WooCommerce | membership-for-woocommerce |
| miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon | miniorange-login-openid |
| Modal Survey – WordPress Poll, Survey & Quiz Plugin | modal-survey |
| MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions | dc-woocommerce-multi-vendor |
| MWB HubSpot for WooCommerce – CRM, Abandoned Cart, Email Marketing, Marketing Automation & Analytics | makewebbetter-hubspot-for-woocommerce |
| New User Approve | new-user-approve |
| Newsletter – Send awesome emails from WordPress | newsletter |
| NGG Smart Image Search | ngg-smart-image-search |
| Nikstore Core | nikstore-core |
| Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More | notification-master |
| NotificationX Pro | notificationx-pro |
| Online Contact Widget-多合一在线客服插件 | online-contact-widget |
| OptionTree | option-tree |
| Outranking Plugin Options | outranking |
| Pay with Contact Form 7 | pay-with-contact-form-7 |
| Paymob for WooCommerce | paymob-for-woocommerce |
| PDF Smart Viewer for Elementor | pdf-smart-viewer-for-elementor |
| Persistent Login | wp-persistent-login |
| Piraeus Bank WooCommerce Payment Gateway | woo-payment-gateway-for-piraeus-bank |
| Podlove Podcast Publisher | podlove-podcasting-plugin-for-wordpress |
| Post Duplicator | post-duplicator |
| PPWP – Password Protect Pages | password-protect-page |
| Premium Packages – Sell Digital Products Securely | wpdm-premium-packages |
| Product Shortlist | product-shortlist |
| Query Wrangler | query-wrangler |
| Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker | quiz-master-next |
| Readabler | readabler |
| Recipe Card Blocks Lite | recipe-card-blocks-by-wpzoom |
| RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login | custom-registration-form-builder-with-submission-manager |
| Restaurant Menu and Food Ordering | mp-restaurant-menu |
| Royal Addons for Elementor – Addons and Templates Kit for Elementor | royal-elementor-addons |
| rtMedia for WordPress, BuddyPress and bbPress | buddypress-media |
| SAML Single Sign On – SSO Login | miniorange-saml-20-single-sign-on |
| Security Hardener | security-hardener |
| Security Plugin, Firewall & Malware Scanner with Auto Removal | security-malware-firewall |
| ShopMonitor.io – Automated Checkout & Form Monitoring | shopmonitorio |
| Simple File List | simple-file-list |
| Simple JWT Login – Allows you to use JWT on REST endpoints. | simple-jwt-login |
| SimplyRETS Real Estate IDX | simply-rets |
| Slider by 10Web – Responsive Image Slider | slider-wd |
| Smart Popup by Supsystic | popup-by-supsystic |
| SmartCrawl SEO checker, analyzer & optimizer | smartcrawl-seo |
| SmartSMTP | smart-smtp |
| Social Media Share Buttons & Social Sharing Icons | ultimate-social-media-icons |
| Speed Optimizer – The All-In-One Performance-Boosting Plugin | sg-cachepress |
| Sticky Chat Widget – Floating Chat Icons, Contact Form, Call, Click to Chat, Email & Message Buttons | sticky-chat-widget |
| Stitch Express | stitch-express |
| Super Store Finder | superstorefinder-wp |
| SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent | supportcandy |
| Swatchly – Product Variation Swatches for WooCommerce | swatchly |
| TabaPay Gateway | tabapay-gateway |
| Table Of Contents Block | table-of-contents-block |
| Tag, Category, and Taxonomy Manager – Autotagger Automatically Add Terms | simple-tags |
| Tagembed: Social Media Feeds and Customer Reviews Widget | tagembed-widget |
| Templatiq | templatiq |
| Themify Builder | themify-builder |
| Tonda Core | tonda-core |
| Total Donations | totaldonations |
| Track Geolocation Of Users Using Contact Form 7 | track-geolocation-of-users-using-contact-form-7 |
| TranslatePress – Translate Multilingual sites with AI Translation | translatepress-multilingual |
| TrueBooker – Appointment Booking and Scheduler System | truebooker-appointment-booking |
| Typing Effect | animated-typing-effect |
| Ultimate Dashboard – Custom WordPress Dashboard | ultimate-dashboard |
| Ultimate Maps by Supsystic | ultimate-maps-by-supsystic |
| URL Shortify – Simple and Easy URL Shortener | url-shortify |
| User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin | user-registration-pro |
| User Verification by PickPlugins | user-verification |
| Verdure Core | verdure-core |
| Video Conferencing with Zoom | video-conferencing-with-zoom-api |
| Visualizer – Tables & Charts Manager with Built-in AI Generator | visualizer |
| W3 Total Cache | w3-total-cache |
| WCFM Marketplace – Multivendor Marketplace for WooCommerce | wc-multivendor-marketplace |
| WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels | print-invoices-packing-slip-labels-for-woocommerce |
| Wise Chat | wise-chat |
| WP BASE Booking of Appointments, Services and Events | wp-base-booking-of-appointments-services-and-events |
| WP Cafe Pro | wpcafe-pro |
| WP Compress – Instant Performance & Speed Optimization | wp-compress-image-optimizer |
| WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards | wp-data-access |
| WP Directory Kit | wpdirectorykit |
| WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters | wp-google-map-plugin |
| WP Multilang – Translation and Multilingual Plugin | wp-multilang |
| WP Project Manager Pro | wedevs-project-manager-business |
| WP Statistics – Simple, privacy-friendly Google Analytics alternative | wp-statistics |
| WP Tab Widget | wp-tab-widget |
| WP w3all phpBB | wp-w3all-phpbb-integration |
| WPAdverts – Classifieds Plugin | wpadverts |
| WPComplete | wpcomplete |
| wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin | wpdatatables |
| WPeMatico RSS Feed Fetcher | wpematico |
| WPForms Pro | wpforms |
| WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode | gdpr-cookie-consent |
| WPS Bidouille | wps-bidouille |
| WPvivid — Backup, Migration & Staging | wpvivid-backuprestore |
| WPZOOM Forms – Drag & Drop Contact Form Builder for WordPress | wpzoom-forms |
| WS Form LITE – Drag & Drop Contact Form Builder | ws-form |
| Wufoo Shortcode | wufoo-shortcode |
| YayCurrency – WooCommerce Multi-Currency Switcher | yaycurrency |
| YITH WooCommerce Membership Premium | yith-woocommerce-membership-premium |
| Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress | youzify |
WordPress Themes with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| Altair | altair |
| Aora – Home & Lifestyle Elementor WooCommerce Theme | aora |
| Capella | Restaurant WordPress | capella |
| Chaplin | chaplin |
| FreightCo – Free Transportation & Logistics WordPress Theme | freightco |
| Homlisti | homlisti |
| IT Residence | it-residence |
| Jawn | jawn |
| Koji | koji |
| Mane | mane |
| Resido – Real Estate WordPress Theme | resido |
| Shuffle | shuffle |
| Smart Cleaning | smart-cleaning |
| TheGem – Creative Multi-Purpose & WooCommerce WordPress Theme | thegem-elementor |
| Tonda – Elegant Shop WordPress Theme | tonda |
| Urna – All-in-one WooCommerce WordPress Theme | urna |
| Warehouse Cargo | warehouse-cargo |
Vulnerability Details
Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.
Affected Software
Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code [automation-web-platform]
Researcher
Affected Software
Broken Link Checker [broken-link-checker]
Researcher
Affected Software
DynamicKit for Elementor [dynamickit-elementor]
Researcher
Affected Software
Elementor Website Builder Pro [elementor-pro]
Researchers
Affected Software
Researcher
Affected Software
Jawn [jawn]
Researcher
Affected Software
JSON Options [json-options]
Researcher
Affected Software
Mailgun for WordPress [mailgun]
Researcher
Affected Software
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates [learning-management-system]
Researcher
Affected Software
ShopMonitor.io – Automated Checkout & Form Monitoring [shopmonitorio]
Researcher
Affected Software
Total Donations [totaldonations]
Researcher
Affected Software
Total Donations [totaldonations]
Researcher
Affected Software
TrueBooker – Appointment Booking and Scheduler System [truebooker-appointment-booking]
Researcher
Affected Software
User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin [user-registration-pro]
Researcher
Affected Software
WP Compress – Instant Performance & Speed Optimization [wp-compress-image-optimizer]
Researcher
Affected Software
Researcher
Affected Software
GP Premium [gp-premium]
Researcher
Affected Software
IT Residence [it-residence]
Researcher
Affected Software
Media Library Assistant [media-library-assistant]
Researcher
Affected Software
PPWP – Password Protect Pages [password-protect-page]
Researcher
Affected Software
Query Wrangler [query-wrangler]
Researcher
Affected Software
Security Hardener [security-hardener]
Researcher
Affected Software
Smart Cleaning [smart-cleaning]
Researcher
Affected Software
Warehouse Cargo [warehouse-cargo]
Researcher
Affected Software
WPeMatico RSS Feed Fetcher [wpematico]
Researcher
Affected Software
Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback [atarim-visual-collaboration]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
FundEngine – Donation and Crowdfunding Platform [wp-fundraising-donation]
Researcher
Affected Software
Golo Framework [golo-framework]
Researcher
Affected Software
Kalles Addons [kalles-addons]
Researcher
Affected Software
Mane [mane]
Researcher
Affected Software
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login [custom-registration-form-builder-with-submission-manager]
Researcher
Affected Software
Resido – Real Estate WordPress Theme [resido]
Researcher
Affected Software
Restaurant Menu and Food Ordering [mp-restaurant-menu]
Researcher
Affected Software
Smart Popup by Supsystic [popup-by-supsystic]
Researcher
Affected Software
Researcher
Affected Software
Tonda Core [tonda-core]
Researcher
Affected Software
Ultimate Maps by Supsystic [ultimate-maps-by-supsystic]
Researcher
Affected Software
Verdure Core [verdure-core]
Researcher
Affected Software
WP Cafe Pro [wpcafe-pro]
Researcher
Affected Software
Researcher
Affected Software
Advanced Product Fields (Product Addons) for WooCommerce [advanced-product-fields-for-woocommerce]
Researcher
Affected Software
Affiliates Manager [affiliates-manager]
Researcher
Affected Software
BookingPress Appointment Booking Pro [bookingpress-appointment-booking-pro]
Researcher
Affected Software
Capella | Restaurant WordPress [capella]
Researcher
Affected Software
Depicter — Popup & Slider Builder [depicter]
Researcher
Affected Software
Dinatur [dinatur]
Affected Software
Directory Pro [directory-pro]
Researcher
Affected Software
Events Made Easy [events-made-easy]
Researcher
Affected Software
Flexible Subscriptions [flexible-subscriptions]
Researcher
Affected Software
JetAppointment [jet-appointments-booking]
Researcher
Affected Software
Locatoraid Store Locator [locatoraid]
Researcher
Affected Software
NGG Smart Image Search [ngg-smart-image-search]
Researcher
Affected Software
Nikstore Core [nikstore-core]
Researcher
Affected Software
Product Shortlist [product-shortlist]
Researcher
Affected Software
rtMedia for WordPress, BuddyPress and bbPress [buddypress-media]
Researcher
Affected Software
Security Plugin, Firewall & Malware Scanner with Auto Removal [security-malware-firewall]
Researcher
Affected Software
Simple File List [simple-file-list]
Researcher
Affected Software
Researcher
Affected Software
Super Store Finder [superstorefinder-wp]
Researcher
Affected Software
TheGem – Creative Multi-Purpose & WooCommerce WordPress Theme [thegem-elementor]
Researcher
Affected Software
W3 Total Cache [w3-total-cache]
Researcher
Affected Software
WP Cafe Pro [wpcafe-pro]
Researcher
Affected Software
WPAdverts – Classifieds Plugin [wpadverts]
Researcher
Affected Software
WPvivid — Backup, Migration & Staging [wpvivid-backuprestore]
Researcher
Affected Software
Abandoned Cart Pro for WooCommerce [woocommerce-abandon-cart-pro]
Researcher
Affected Software
Capella | Restaurant WordPress [capella]
Researcher
Affected Software
Researcher
Affected Software
SAML Single Sign On – SSO Login [miniorange-saml-20-single-sign-on]
Researcher
Affected Software
Simple JWT Login – Allows you to use JWT on REST endpoints. [simple-jwt-login]
Researcher
Affected Software
TabaPay Gateway [tabapay-gateway]
Researcher
TrueBooker – Appointment Booking and Scheduler System < 1.2.7 – Unauthenticated Privilege Escalation
7.3
Affected Software
TrueBooker – Appointment Booking and Scheduler System [truebooker-appointment-booking]
Researcher
Affected Software
TrueBooker – Appointment Booking and Scheduler System [truebooker-appointment-booking]
Researcher
Affected Software
12 Step Meeting List [12-step-meeting-list]
Researcher
Affected Software
Advance Product Search- Voice & Ajax Search for WooCommerce [th-advance-product-search]
Researcher
Affected Software
Affiliates Manager [affiliates-manager]
Researcher
All-in-One WP Migration and Backup < 7.108 – Authenticated (Administrator+) Remote Code Execution
7.2
Affected Software
All-in-One WP Migration and Backup [all-in-one-wp-migration]
Researcher
Affected Software
Affected Software
Autopay [platnosci-online-blue-media]
Researcher
Affected Software
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages]
Researcher
Booking calendar, Appointment Booking System <= 3.2.36 – Unauthenticated Stored Cross-Site Scripting
7.2
Affected Software
Booking calendar, Appointment Booking System [booking-calendar]
Researcher
Affected Software
Contact Form by Supsystic [contact-form-by-supsystic]
Researcher
Affected Software
Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe [contest-gallery]
Researcher
Affected Software
Depicter — Popup & Slider Builder [depicter]
Researcher
Affected Software
EasyTest – Simplify A/B Testing [convertpro]
Researcher
Affected Software
Events Made Easy [events-made-easy]
Researcher
Affected Software
Researcher
Affected Software
Fluent Forms Pro Add On Pack [fluentformpro]
Researcher
Affected Software
Researcher
Affected Software
GEO Plugin by Squirrly SEO [squirrly-seo]
Researcher
Affected Software
Researcher
Affected Software
Global Gallery – WordPress Responsive Gallery [global-gallery]
Researcher
Affected Software
Researcher
Affected Software
miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon [miniorange-login-openid]
Researcher
Affected Software
Researcher
Affected Software
NotificationX Pro [notificationx-pro]
Researcher
Affected Software
Paymob for WooCommerce [paymob-for-woocommerce]
Researcher
Affected Software
PDF Smart Viewer for Elementor [pdf-smart-viewer-for-elementor]
Researcher
Affected Software
Podlove Podcast Publisher [podlove-podcasting-plugin-for-wordpress]
Researcher
Affected Software
Premium Packages – Sell Digital Products Securely [wpdm-premium-packages]
Researcher
Affected Software
Recipe Card Blocks Lite [recipe-card-blocks-by-wpzoom]
Researcher
Affected Software
Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons]
Researcher
Affected Software
Simple File List [simple-file-list]
Researcher
Affected Software
SimplyRETS Real Estate IDX [simply-rets]
Researcher
Affected Software
Social Media Share Buttons & Social Sharing Icons [ultimate-social-media-icons]
Researcher
Affected Software
Researcher
Affected Software
Tagembed: Social Media Feeds and Customer Reviews Widget [tagembed-widget]
Researcher
Affected Software
10Web Booster – Website speed optimization, Cache & Page Speed optimizer [tenweb-speed-optimizer]
Researcher
Affected Software
TranslatePress – Translate Multilingual sites with AI Translation [translatepress-multilingual]
Researcher
Affected Software
TranslatePress – Translate Multilingual sites with AI Translation [translatepress-multilingual]
Researcher
Affected Software
Ultimate Dashboard – Custom WordPress Dashboard [ultimate-dashboard]
Researcher
Affected Software
Ultimate Maps by Supsystic [ultimate-maps-by-supsystic]
Researcher
URL Shortify – Simple and Easy URL Shortener <= 2.5.0 – Unauthenticated Stored Cross-Site Scripting
7.2
Affected Software
URL Shortify – Simple and Easy URL Shortener [url-shortify]
Researcher
Urna – All-in-one WooCommerce WordPress Theme <= 2.6.2 – Unauthenticated Stored Cross-Site Scripting
7.2
Affected Software
Researchers
Affected Software
WP Multilang – Translation and Multilingual Plugin [wp-multilang]
Researcher
WP Statistics <= 14.16.8 – Unauthenticated Stored Cross-Site Scripting via ‘utm_campaign’ Parameter
7.2
Affected Software
Researcher
Affected Software
WPComplete [wpcomplete]
Researcher
Affected Software
Researcher
Affected Software
WPForms Pro [wpforms]
Researcher
Affected Software
OptionTree [option-tree]
Researcher
Affected Software
Researcher
Affected Software
Community by PeepSo – Download from PeepSo.com [peepso-core]
Researcher
Affected Software
eShipper Commerce [eshipper-commerce]
Researcher
Affected Software
License Manager for WooCommerce [license-manager-for-woocommerce]
Researcher
Affected Software
Persistent Login [wp-persistent-login]
Researcher
Affected Software
WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels [print-invoices-packing-slip-labels-for-woocommerce]
Researcher
Affected Software
WP Project Manager Pro [wedevs-project-manager-business]
Researcher
Affected Software
WP w3all phpBB [wp-w3all-phpbb-integration]
Researcher
Affected Software
YITH WooCommerce Membership Premium [yith-woocommerce-membership-premium]
Researcher
Affected Software
Admin and Site Enhancements (ASE) [admin-site-enhancements]
Researcher
Affected Software
Draft List [simple-draft-list]
Researcher
Affected Software
Easy Media Replace [easy-media-replace]
Researcher
Affected Software
EWWW Image Optimizer [ewww-image-optimizer]
Researcher
Affected Software
Featured Video Plus [featured-video-plus]
Researcher
Frontend Admin by DynamiApps <= 3.29.10 – Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
Frontend Admin by DynamiApps [acf-frontend-form-element]
Researcher
Affected Software
Researcher
Affected Software
GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor [gutenkit-blocks-addon]
Researcher
Affected Software
Image Photo Gallery Final Tiles Grid [final-tiles-grid-gallery-lite]
Affected Software
Login With Ajax – Fast Logins, 2FA, Redirects [login-with-ajax]
Researcher
Affected Software
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates [learning-management-system]
Researcher
Affected Software
MC4WP: Mailchimp for WordPress [mailchimp-for-wp]
Researcher
Affected Software
Media Library Assistant [media-library-assistant]
Researcher
Affected Software
Media Library Assistant [media-library-assistant]
Researcher
Affected Software
Speed Optimizer – The All-In-One Performance-Boosting Plugin [sg-cachepress]
Researcher
Affected Software
Table Of Contents Block [table-of-contents-block]
Researcher
Affected Software
Typing Effect [animated-typing-effect]
Researcher
Video Conferencing with Zoom <= 4.6.8 – Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
Video Conferencing with Zoom [video-conferencing-with-zoom-api]
Researcher
Affected Software
Wise Chat [wise-chat]
Researcher
Affected Software
WP BASE Booking of Appointments, Services and Events [wp-base-booking-of-appointments-services-and-events]
Researcher
Affected Software
WP Tab Widget [wp-tab-widget]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Wufoo Shortcode [wufoo-shortcode]
Researcher
Affected Software
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution]
Researcher
Affected Software
MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system]
Researcher
Affected Software
WCFM Marketplace – Multivendor Marketplace for WooCommerce [wc-multivendor-marketplace]
Researcher
Affected Software
AI Agent by SiteGround [sg-ai-studio]
Researcher
Affected Software
Altair [altair]
Researcher
Affected Software
Appointment Hour Booking – Booking Calendar [appointment-hour-booking]
Researcher
Affected Software
Booking calendar, Appointment Booking System [booking-calendar]
Researcher
Affected Software
CatFolders Document Gallery & PDF Library [catfolders-document-gallery]
Researcher
Affected Software
Chaplin [chaplin]
Researcher
Affected Software
Researcher
Affected Software
Contact Form by Supsystic [contact-form-by-supsystic]
Researcher
Affected Software
Duitku Payment Gateway [duitku-social-payment-gateway]
Researcher
Affected Software
E-cab Taxi Booking Manager for Woocommerce [ecab-taxi-booking-manager]
Researcher
Affected Software
EPROLO-Dropshipping [eprolo-dropshipping]
Researcher
Affected Software
Estatik Real Estate Plugin [estatik]
Researcher
Affected Software
Extra Product Options Builder for WooCommerce [additional-product-fields-for-woocommerce]
Researcher
Affected Software
Flutterwave WooCommerce [rave-woocommerce-payment-gateway]
Researcher
kk Star Ratings <= 5.4.10.3 – Unauthenticated Arbitrary Shortcode Execution via ‘payload’ Parameter
5.3
Affected Software
kk Star Ratings – Rate Post & Collect User Feedbacks [kk-star-ratings]
Affected Software
Koji [koji]
Researcher
Affected Software
Membership For WooCommerce [membership-for-woocommerce]
Researcher
Affected Software
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions [dc-woocommerce-multi-vendor]
Researcher
Affected Software
New User Approve [new-user-approve]
Researcher
Affected Software
Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More [notification-master]
Researcher
Affected Software
Online Contact Widget-多合一在线客服插件 [online-contact-widget]
Researcher
Affected Software
Outranking Plugin Options [outranking]
Researcher
Affected Software
Pay with Contact Form 7 [pay-with-contact-form-7]
Researcher
Affected Software
Piraeus Bank WooCommerce Payment Gateway [woo-payment-gateway-for-piraeus-bank]
Researcher
Affected Software
Smart Popup by Supsystic [popup-by-supsystic]
Researcher
Affected Software
Stitch Express [stitch-express]
Researcher
Affected Software
Researcher
Affected Software
Themify Builder [themify-builder]
Researcher
Affected Software
Track Geolocation Of Users Using Contact Form 7 [track-geolocation-of-users-using-contact-form-7]
Researcher
Affected Software
TrueBooker – Appointment Booking and Scheduler System [truebooker-appointment-booking]
Researcher
Affected Software
TrueBooker – Appointment Booking and Scheduler System [truebooker-appointment-booking]
Researcher
TrueBooker – Appointment Booking and Scheduler System < 1.2.7 – Unauthenticated Information Exposure
5.3
Affected Software
TrueBooker – Appointment Booking and Scheduler System [truebooker-appointment-booking]
Researcher
Affected Software
Ultimate Maps by Supsystic [ultimate-maps-by-supsystic]
Researcher
Affected Software
User Verification by PickPlugins [user-verification]
Researcher
Affected Software
Researcher
Affected Software
WP Directory Kit [wpdirectorykit]
Researcher
YayCurrency – WooCommerce Multi-Currency Switcher < 3.3.5 – Unauthenticated Information Exposure
5.3
Affected Software
YayCurrency – WooCommerce Multi-Currency Switcher [yaycurrency]
Researcher
Affected Software
InfiniteWP Client [iwp-client]
Researcher
Affected Software
WP Directory Kit [wpdirectorykit]
Researcher
Affected Software
Issues and Series for Newspapers, Magazines, Publishers, Writers [organize-series]
Researcher
Affected Software
Researcher
Affected Software
Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution [file-manager-advanced]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More [b2bking-wholesale-for-woocommerce]
Researcher
Affected Software
Easy Appointments [easy-appointments]
Researcher
Easy Elementor Addons – Addons Pack for Elementor Page Builder <= 2.3.7 – Cross-Site Request Forgery
4.3
Affected Software
Easy Elementor Addons – Addons Pack for Elementor Page Builder [easy-elementor-addons]
Researcher
Affected Software
ECS – Ele Custom Skin for Elementor [ele-custom-skin]
Researcher
Affected Software
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution]
Researcher
Affected Software
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution]
Researcher
Affected Software
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution]
Researcher
Affected Software
Greenshift – animation and page builder blocks [greenshift-animation-and-page-builder-blocks]
Researcher
Affected Software
GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor [gutenkit-blocks-addon]
Researcher
Affected Software
HashBar – Announcement, Notification Bar & Popup Campaign [hashbar-wp-notification-bar]
Researcher
Affected Software
Homlisti [homlisti]
Researcher
Affected Software
KiviCare – Clinic & Patient Management System (EHR) [kivicare-clinic-management-system]
Researcher
Affected Software
KiviCare – Clinic & Patient Management System (EHR) [kivicare-clinic-management-system]
Researcher
Affected Software
Leyka [leyka]
Researcher
Affected Software
Manual Image Crop [manual-image-crop]
Researcher
Affected Software
MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system]
Researcher
Affected Software
Modal Survey – WordPress Poll, Survey & Quiz Plugin [modal-survey]
Researcher
Affected Software
MWB HubSpot for WooCommerce – CRM, Abandoned Cart, Email Marketing, Marketing Automation & Analytics [makewebbetter-hubspot-for-woocommerce]
Researcher
Post Duplicator <= 3.0.11 – Authorization Bypass to Authenticated (Contributor+) Post Duplication
4.3
Affected Software
Post Duplicator [post-duplicator]
Researcher
Affected Software
Post Duplicator [post-duplicator]
Researcher
Affected Software
PPWP – Password Protect Pages [password-protect-page]
Researcher
Affected Software
Premium Packages – Sell Digital Products Securely [wpdm-premium-packages]
Researcher
Quiz And Survey Master <= 11.2.3 – Authenticated (Contributor+) Insecure Direct Object Reference
4.3
Affected Software
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker [quiz-master-next]
Researcher
Quiz And Survey Master <= 11.2.3 – Authenticated (Contributor+) Insecure Direct Object Reference
4.3
Affected Software
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker [quiz-master-next]
Researcher
Affected Software
Slider by 10Web – Responsive Image Slider [slider-wd]
Researcher
Affected Software
SmartCrawl SEO checker, analyzer & optimizer [smartcrawl-seo]
Researcher
Affected Software
Researcher
Affected Software
WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters [wp-google-map-plugin]
Researcher
Affected Software
WPS Bidouille [wps-bidouille]
Researcher
As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.
This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
The post Wordfence Intelligence Weekly WordPress Vulnerability Report (August 17, 2026 to August 23, 2026) appeared first on Wordfence.