Last week, there were 277 vulnerabilities disclosed in 187 WordPress Plugins and 7 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 153 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.
Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back.
Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 35,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
New Firewall Rules Deployed Last Week
The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.
The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:
- WAF-RULE-956 – Data redacted while we work with the vendor on a patch.
Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.
Total Unpatched & Patched Vulnerabilities Last Week
| Patch Status | Number of Vulnerabilities |
|---|---|
| Patched | 254 |
| Unpatched | 23 |
Total Vulnerabilities by CVSS Severity Last Week
| Severity Rating | Number of Vulnerabilities |
|---|---|
| Low Severity | 1 |
| Medium Severity | 185 |
| High Severity | 75 |
| Critical Severity | 16 |
Total Vulnerabilities by CWE Type Last Week
| Vulnerability Type by CWE | Number of Vulnerabilities |
|---|---|
| Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) | 91 |
| Missing Authorization | 52 |
| Authorization Bypass Through User-Controlled Key | 19 |
| Exposure of Sensitive Information to an Unauthorized Actor | 17 |
| Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) | 16 |
| Improper Privilege Management | 14 |
| Deserialization of Untrusted Data | 10 |
| Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) | 9 |
| Improper Control of Generation of Code (‘Code Injection’) | 7 |
| Server-Side Request Forgery (SSRF) | 7 |
| Cross-Site Request Forgery (CSRF) | 6 |
| Improper Authentication | 6 |
| Client-Side Enforcement of Server-Side Security | 5 |
| Uncontrolled Resource Consumption | 5 |
| Unrestricted Upload of File with Dangerous Type | 5 |
| Insufficient Verification of Data Authenticity | 2 |
| Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’) | 1 |
| Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Request/Response Splitting’) | 1 |
| Improper Neutralization of Special Elements used in a Command (‘Command Injection’) | 1 |
| Incorrect Authorization | 1 |
| Unverified Password Change | 1 |
| URL Redirection to Untrusted Site (‘Open Redirect’) | 1 |
Researchers That Contributed to WordPress Security Last Week
| Researcher Name | Number of Vulnerabilities |
|---|---|
| 17 | |
| 12 | |
| 11 | |
| 9 | |
| 7 | |
| 6 | |
| 6 | |
| 5 | |
| 5 | |
| 5 | |
| 5 | |
| 5 | |
| 4 | |
| 4 | |
| 4 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.
WordPress Plugins with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| Abandoned Cart Pro for WooCommerce | woocommerce-abandon-cart-pro |
| Accept Stripe Payments | stripe-payments |
| ACPT (Premium) | advanced-custom-post-type |
| Activity Log – Monitor User and Agent Changes | aryo-activity-log |
| Advanced Custom Fields: Extended | acf-extended |
| Affiliate Super Assistent | amazonsimpleadmin |
| Agentimus – AI SEO, llms.txt & MCP for AI Agents | agentimus |
| All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) | all-in-one-seo-pack |
| Authorizer | authorizer |
| B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More | b2bking-wholesale-for-woocommerce |
| bbPress | bbpress |
| Beaver Builder Plugin (Starter Version) | bb-plugin |
| Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots | bp-better-messages |
| BetterDocs – AI Documentation, Knowledge Base, MCP Server, Docs, Wikis, FAQ & Chatbot | betterdocs |
| Blocksy Companion | blocksy-companion |
| Bold Page Builder | bold-page-builder |
| Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment | booking-and-rental-manager-for-woocommerce |
| Booking for Appointments and Events Calendar – Amelia | ameliabooking |
| Booking Hub – AI-Powered Scheduling, Reservation and Appointment System for WordPress | booking-hub |
| Bookit — Booking & Appointment Calendar | bookit |
| Breadcrumb NavXT | breadcrumb-navxt |
| Breakdance | breakdance |
| Bricksforge | bricksforge |
| Broken Link Checker | broken-link-checker |
| Business Directory Plugin – Easy Listing & Member Directories for WordPress | business-directory-plugin |
| Calculation for contact form 7 | calculation-for-contact-form-7 |
| CatalogX – Catalog Mode, Enquiry & Quotes for WooCommerce | woocommerce-catalog-enquiry |
| CatFolders Document Gallery & PDF Library | catfolders-document-gallery |
| Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) | charitable |
| Classified Listing – AI-Powered Classified ads & Business Directory | classified-listing |
| Comments – wpDiscuz | wpdiscuz |
| Contact Form by Supsystic | contact-form-by-supsystic |
| Content Views – Post Grid & Filter (Shortcode, Blocks, Elementor Widgets) | content-views-query-and-display-post-page |
| Cozy Blocks – Website Builder for Block Editor | 58 Gutenberg Blocks, 700+ Patterns, 50+ Templates | cozy-addons |
| Custom Contact Forms | custom-contact-forms |
| Customer Reviews for WooCommerce | customer-reviews-woocommerce |
| DearFlip – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer | 3d-flipbook-dflip-lite |
| DevKit Pro | devkit |
| Directorist: AI-Powered Business Directory, Listings & Classified Ads | directorist |
| Divi Ajax Filter | divi-ajax-filter |
| E-cab Taxi Booking Manager for Woocommerce | ecab-taxi-booking-manager |
| Easy Waveform Player | easy-waveform-player |
| EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents | embedpress |
| ePayco plugin for WooCommerce | epayco-gateway |
| Estatik Real Estate Plugin | estatik |
| Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce | wp-event-solution |
| Events Manager – Calendar, Bookings, Tickets, and more! | events-manager |
| EWWW Image Optimizer | ewww-image-optimizer |
| FAQ Builder AYS | faq-builder-ays |
| Flamingo | flamingo |
| Fluent Booking Pro | fluent-booking-pro |
| FormLayer | formlayer |
| Frontend Admin by DynamiApps | acf-frontend-form-element |
| FS Poster – WordPress Social media Auto Poster & Scheduler [Facebook, Instagram, Twitter, Pinterest] | fs-poster |
| Gallery : FooGallery | foogallery |
| Gallery PhotoBlocks | photoblocks-grid-gallery |
| GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI | gamipress |
| GeoDirectory – WP Business Directory Plugin and Classified Listings Directory | geodirectory |
| Gravity Forms | gravityforms |
| Greenshift – animation and page builder blocks | greenshift-animation-and-page-builder-blocks |
| Groundhogg — CRM, Newsletters, and Marketing Automation | groundhogg |
| GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor | gutenkit-blocks-addon |
| Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor | gutentor |
| HEL Online Classroom: AI-powered Online Classrooms | hel-online-classroom |
| HivePress Authentication | hivepress-authentication |
| Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN | hummingbird-performance |
| iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more | iubenda-cookie-law-solution |
| JCH Optimize | jch-optimize |
| JetBackup – Backup, Restore & Migrate | backup |
| JetFormBuilder — Dynamic Blocks Form Builder | jetformbuilder |
| Jetpack – WP Security, Backup, Speed, & Growth | jetpack |
| JetPopup | jet-popup |
| JetStyleManager for Gutenberg | jet-style-manager |
| JobSearch WP Job Board | wp-jobsearch |
| Joli Table Of Contents | joli-table-of-contents |
| Kalles Addons | kalles-addons |
| King Addons for Elementor – 80+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce, Mega Menu, Popup Builder | king-addons |
| Kirki – Freeform Page Builder, Website Builder & Customizer | kirki |
| KP Agent Ready | kp-agent-ready |
| LearnDash LMS | sfwd-lms |
| LearnPress – WordPress LMS Plugin for Create and Sell Online Courses | learnpress |
| Listdom: AI-powered Business Directory with Classifieds Ads Listings | listdom |
| LiteSpeed Cache | litespeed-cache |
| Live Composer – Free WordPress Website Builder | live-composer-page-builder |
| Login With Ajax – Fast Logins, 2FA, Redirects | login-with-ajax |
| Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance | mail-mint |
| MalCare WordPress Security Plugin – Malware Scanner, Cleaner, Security Firewall | malcare-security |
| Mang Board WP | mangboard |
| MapGeo – Interactive Geo Maps | interactive-geo-maps |
| MapSVG – Vector maps, Image maps, Google Maps | mapsvg-lite-interactive-vector-maps |
| MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution | marketking-multivendor-marketplace-for-woocommerce |
| Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits | master-addons |
| Masteriyo LMS – LMS Course Builder, Quizzes & Certificates | learning-management-system |
| MasterStudy LMS WordPress Plugin – for Online Courses and Education | masterstudy-lms-learning-management-system |
| MemberDash | memberdash |
| MemberHero – Simple User Registration & Login | wp-registration |
| Migrate Guru – Site Migration & Cloning | migrate-guru |
| MotoPress Appointment Booking | motopress-appointment-lite |
| MountDev AI MCP Connector for WordPress | mountdev-ai-mcp-connector |
| MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar | mp3-music-player-by-sonaar |
| MStore API – Create Native Android & iOS Apps On The Cloud | mstore-api |
| MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions | dc-woocommerce-multi-vendor |
| My Private Site – Make Your Whole Site Private, Force Login & Block Registration Spam | jonradio-private-site |
| Ninja Forms – File Uploads | ninja-forms-uploads |
| Ninja Forms – Layout & Styles | ninja-forms-style |
| Ninja Forms – Save Progress | ninja-forms-save-progress |
| Ninja Forms – Scheduled Exports | ninja-forms-scheduled-exports |
| Ninja Forms – The Contact Form Builder That Grows With You | ninja-forms |
| Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE | otter-blocks |
| Oxygen | oxygen |
| Persistent Login | wp-persistent-login |
| Photo Gallery by 10Web – Mobile-Friendly Image Gallery | photo-gallery |
| Photo Gallery by Ays – Responsive Image Gallery | gallery-photo-gallery |
| Pods – Custom Content Types and Fields | pods |
| Post Grid | post-grid |
| Powerkit – Supercharge your WordPress Site | powerkit |
| Pre-Orders for WooCommerce | pre-orders-for-woocommerce |
| Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce | a4-barcode-generator |
| Product Attachment for WooCommerce | woo-product-attachment |
| Product Variations Swatches for WooCommerce | product-variations-swatches-for-woocommerce |
| PublishPress Permissions: Access Control, Content Permissions, User Access | press-permit-core |
| Quick Event Manager | quick-event-manager |
| QuickCal | quickcal |
| Rank Math SEO – AI SEO Tools to Dominate SEO Rankings | seo-by-rank-math |
| Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) | really-simple-ssl |
| Redirection for Contact Form 7 | wpcf7-redirect |
| RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login | custom-registration-form-builder-with-submission-manager |
| RentSyst – CRM solution for fleet management | rentsyst |
| Rest Routes – Custom Endpoints for WordPress REST API | rest-routes |
| Restaurant Menu and Food Ordering | mp-restaurant-menu |
| RTMKit | rometheme-for-elementor |
| Search Atlas SEO – OTTO AI SEO Automation for WordPress | metasync |
| SEOPress – AI SEO Plugin & On-site SEO | wp-seopress |
| Shared Files Pro | shared-files-pro |
| Shopping Cart & eCommerce Store | wp-easycart |
| SigmaForms Pro – AI Generated Forms | sigmaforms-pro |
| Simple Ajax Chat – Add a Fast, Secure Chat Box | simple-ajax-chat |
| Simple Membership | simple-membership |
| Simple Payment | simple-payment |
| Simply Schedule Appointments | simply-schedule-appointments |
| Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News | post-carousel |
| SmartyParcel – Multi-Carrier Shipping, Order Tracking & Live Rates for WooCommerce | wc-ukr-shipping |
| Social Chat – Click To Chat App Button | wp-whatsapp-chat |
| Social Media Share Buttons & Social Sharing Icons | ultimate-social-media-icons |
| Solace Extra | solace-extra |
| Spam protection, Honeypot, Anti-Spam by CleanTalk | cleantalk-spam-protect |
| Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System | support-genix-lite |
| SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz | sureforms |
| The Events Calendar | the-events-calendar |
| Theme My Login | theme-my-login |
| Timetics – Appointment Booking Calendar & Scheduling | timetics |
| Total processing card payments for WooCommerce | totalprocessing-card-payments |
| TrustedSite | trustedsite |
| Uix UserCenter | uix-usercenter |
| Ultimate Before After Image Slider & Gallery – BEAF | beaf-before-and-after-gallery |
| Ultimate Gift Cards for WooCommerce | woo-gift-cards-lite |
| Ultimate Maps by Supsystic | ultimate-maps-by-supsystic |
| Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin | ultimate-member |
| Under Construction | under-construction-page |
| Unlimited Elements For Elementor | unlimited-elements-for-elementor |
| Upsell Funnel Builder for WooCommerce – Create Upsells, Cross-Sells, Order Bumps, Frequently Bought, and Popups. | upsell-order-bump-offer-for-woocommerce |
| User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission | wp-user-frontend |
| User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor | profile-builder |
| Video Player for YouTube – Embed Videos Your Visitors Will Love to Watch | yt-player |
| VikAppointments Services Booking Calendar | vikappointments |
| VikWidgetsLoader – Collection of Widgets | vikwidgetsloader |
| W3 Total Cache | w3-total-cache |
| WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors | wc-vendors |
| WCFM Marketplace – Multivendor Marketplace for WooCommerce | wc-multivendor-marketplace |
| WCFM Membership – WooCommerce Memberships for Multivendor Marketplace | wc-multivendor-membership |
| Welcart e-Commerce | usc-e-shop |
| WooCommerce | woocommerce |
| WP Compress – Instant Performance & Speed Optimization | wp-compress-image-optimizer |
| WP Easy Pay – Payment and Donation Form Builder for Square | wp-easy-pay |
| WP Express Checkout (Fast Payments via PayPal & Stripe) | wp-express-checkout |
| WP File Download | wp-file-download |
| WP Go Maps – Google Map, OpenStreetMap, Leaflet Map | wp-google-maps |
| WP QuickLaTeX | wp-quicklatex |
| WP Recipe Maker Premium | wp-recipe-maker-premium |
| WP Statistics – Simple, privacy-friendly Google Analytics alternative | wp-statistics |
| WPBakery Page Builder | js_composer |
| WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell | wpfunnels |
| WPKoi Templates for Elementor | wpkoi-templates-for-elementor |
| WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode | gdpr-cookie-consent |
| WPvivid — Backup, Migration & Staging | wpvivid-backuprestore |
| Xpro Addons — 150+ Widgets for Elementor | xpro-elementor-addons |
| YITH Request a Quote for WooCommerce | yith-woocommerce-request-a-quote-premium |
WordPress Themes with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| Divi | Divi |
| enfold | enfold |
| Grand Tour | Travel Agency WordPress | grandtour |
| Graphene | graphene |
| Nokri – Job Board WordPress Theme | nokri |
| Woodmart | woodmart |
| WP Rentals – Booking Accommodation WordPress Theme | wprentals |
Vulnerability Details
Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.
ACPT (Premium) <= 2.0.66 – Unauthenticated Privilege Escalation via ‘acpt_form_post_id’ Parameter
9.8
Affected Software
ACPT (Premium) [advanced-custom-post-type]
Researcher
Affected Software
Advanced Custom Fields: Extended [acf-extended]
Researcher
Affected Software
Authorizer [authorizer]
Researcher
Affected Software
Booking for Appointments and Events Calendar – Amelia [ameliabooking]
Researcher
Affected Software
Divi Ajax Filter [divi-ajax-filter]
Researcher
Affected Software
Frontend Admin by DynamiApps [acf-frontend-form-element]
Researcher
Affected Software
Researcher
Affected Software
JetFormBuilder — Dynamic Blocks Form Builder [jetformbuilder]
Researcher
Affected Software
Researcher
Affected Software
MemberDash [memberdash]
Researcher
MStore API <= 4.20.0 – Unauthenticated Authentication Bypass via ‘id_token’ Parameter JWT Forgery
9.8
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Post Grid [post-grid]
Researcher
Affected Software
SigmaForms Pro – AI Generated Forms [sigmaforms-pro]
Researchers
Affected Software
Researcher
WPLP Cookie Consent <= 4.4.1 – Unauthenticated Arbitrary File Upload via ‘upload-logo’ REST Endpoint
9.8
Affected Software
Researcher
Affected Software
Abandoned Cart Pro for WooCommerce [woocommerce-abandon-cart-pro]
Researcher
Affected Software
DevKit Pro [devkit]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Welcart e-Commerce [usc-e-shop]
Researcher
Affected Software
Gravity Forms [gravityforms]
Researchers
Affected Software
JobSearch WP Job Board [wp-jobsearch]
Researcher
Affected Software
Researcher
Affected Software
Ninja Forms – Layout & Styles [ninja-forms-style]
Researcher
Affected Software
WP File Download [wp-file-download]
Researcher
Affected Software
Comments – wpDiscuz [wpdiscuz]
Researcher
Affected Software
Frontend Admin by DynamiApps [acf-frontend-form-element]
Researcher
Affected Software
Researcher
Affected Software
HivePress Authentication [hivepress-authentication]
Researcher
Affected Software
LearnDash LMS [sfwd-lms]
Researcher
Affected Software
Researcher
Affected Software
Migrate Guru – Site Migration & Cloning [migrate-guru]
Researcher
Affected Software
Researcher
Affected Software
Rest Routes – Custom Endpoints for WordPress REST API [rest-routes]
Affected Software
Shared Files Pro [shared-files-pro]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
VikAppointments Services Booking Calendar [vikappointments]
Researcher
WCFM Marketplace – Multivendor Marketplace for WooCommerce <= 3.8.1 – Unauthenticated SQL Injection
7.5
Affected Software
WCFM Marketplace – Multivendor Marketplace for WooCommerce [wc-multivendor-marketplace]
Researcher
WP Go Maps – Google Map, OpenStreetMap, Leaflet Map <= 10.1.08 – Unauthenticated Denial of Service
7.5
Affected Software
WP Go Maps – Google Map, OpenStreetMap, Leaflet Map [wp-google-maps]
Researcher
Affected Software
Advanced Custom Fields: Extended [acf-extended]
Researcher
Affected Software
MemberHero – Simple User Registration & Login [wp-registration]
Researcher
Affected Software
Uix UserCenter [uix-usercenter]
Researcher
Affected Software
Affiliate Super Assistent [amazonsimpleadmin]
Researcher
Affected Software
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages]
Researcher
Affected Software
Breadcrumb NavXT [breadcrumb-navxt]
Researcher
Affected Software
Broken Link Checker [broken-link-checker]
Researcher
Affected Software
Calculation for contact form 7 [calculation-for-contact-form-7]
Researcher
Affected Software
Contact Form by Supsystic [contact-form-by-supsystic]
Researcher
Affected Software
Customer Reviews for WooCommerce [customer-reviews-woocommerce]
Researcher
Affected Software
enfold [enfold]
Researcher
Affected Software
Estatik Real Estate Plugin [estatik]
Researcher
Affected Software
EWWW Image Optimizer [ewww-image-optimizer]
Researcher
Affected Software
FAQ Builder AYS [faq-builder-ays]
Affected Software
Gravity Forms [gravityforms]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more [iubenda-cookie-law-solution]
Researcher
Affected Software
iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more [iubenda-cookie-law-solution]
Researcher
JetFormBuilder — Dynamic Blocks Form Builder < 3.6.5.2 – Unauthenticated Stored Cross-Site Scripting
7.2
Affected Software
JetFormBuilder — Dynamic Blocks Form Builder [jetformbuilder]
Researcher
Affected Software
Researcher
Affected Software
LiteSpeed Cache [litespeed-cache]
Researcher
Affected Software
MapSVG – Vector maps, Image maps, Google Maps [mapsvg-lite-interactive-vector-maps]
Researcher
Affected Software
Researcher
Affected Software
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar [mp3-music-player-by-sonaar]
Researcher
Affected Software
Ninja Forms – File Uploads [ninja-forms-uploads]
Researcher
Affected Software
Researcher
Affected Software
Quick Event Manager [quick-event-manager]
Researcher
Affected Software
QuickCal [quickcal]
Researcher
Affected Software
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login [custom-registration-form-builder-with-submission-manager]
Researcher
Affected Software
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login [custom-registration-form-builder-with-submission-manager]
Researcher
Affected Software
RTMKit [rometheme-for-elementor]
Researcher
Affected Software
Simple Ajax Chat – Add a Fast, Secure Chat Box [simple-ajax-chat]
Researcher
Affected Software
Simple Payment [simple-payment]
Researcher
Affected Software
Spam protection, Honeypot, Anti-Spam by CleanTalk [cleantalk-spam-protect]
Researcher
Affected Software
Researcher
Total processing card payments for WooCommerce <= 7.3 – Unauthenticated Server-Side Request Forgery
7.2
Affected Software
Total processing card payments for WooCommerce [totalprocessing-card-payments]
Affected Software
TrustedSite [trustedsite]
Researcher
Affected Software
Under Construction [under-construction-page]
Researcher
Affected Software
Upsell Funnel Builder for WooCommerce – Create Upsells, Cross-Sells, Order Bumps, Frequently Bought, and Popups. [upsell-order-bump-offer-for-woocommerce]
Researcher
Affected Software
Researcher
Affected Software
W3 Total Cache [w3-total-cache]
Researcher
Affected Software
Welcart e-Commerce [usc-e-shop]
Researcher
Affected Software
WP QuickLaTeX [wp-quicklatex]
Researcher
Affected Software
Researcher
Affected Software
WPvivid — Backup, Migration & Staging [wpvivid-backuprestore]
Researcher
Patch Status
Patched
Patched
Published
Sep 5, 2026
Sep 5, 2026
Affected Software
Researcher
Affected Software
Researcher
Charitable <= 1.8.12.1 – Authenticated (Contributor+) SQL Injection via ‘order’ Shortcode Attribute
6.5
Affected Software
Researcher
Affected Software
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution]
Researcher
Affected Software
Researcher
Persistent Login <= 3.1.0 – Authenticated (Subscriber+) SQL Injection via ‘wppl_device_id’ Cookie
6.5
Affected Software
Persistent Login [wp-persistent-login]
Researcher
Pods – Custom Content Types and Fields 3.3 – 3.3.9.1 – Authenticated (Author+) Arbitrary File Read
6.5
Affected Software
Researcher
Affected Software
Redirection for Contact Form 7 [wpcf7-redirect]
Researcher
Affected Software
Researcher
Affected Software
WP File Download [wp-file-download]
Researcher
Affected Software
WPvivid — Backup, Migration & Staging [wpvivid-backuprestore]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Blocksy Companion [blocksy-companion]
Researcher
Affected Software
Bold Page Builder [bold-page-builder]
Researcher
Affected Software
Bold Page Builder [bold-page-builder]
Researcher
Affected Software
Bold Page Builder [bold-page-builder]
Researcher
Affected Software
Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment [booking-and-rental-manager-for-woocommerce]
Researcher
Affected Software
CatFolders Document Gallery & PDF Library [catfolders-document-gallery]
Researcher
Affected Software
DearFlip – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer [3d-flipbook-dflip-lite]
Researcher
Affected Software
DearFlip – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer [3d-flipbook-dflip-lite]
Researcher
Affected Software
Divi [Divi]
Researcher
Affected Software
Divi [Divi]
Researcher
Affected Software
Divi [Divi]
Researcher
Affected Software
Divi [Divi]
Researcher
Affected Software
Easy Waveform Player [easy-waveform-player]
Researcher
Affected Software
Frontend Admin by DynamiApps [acf-frontend-form-element]
Researcher
Affected Software
Gallery : FooGallery [foogallery]
Researcher
Affected Software
Gallery PhotoBlocks [photoblocks-grid-gallery]
Researcher
Affected Software
Graphene [graphene]
Researcher
Affected Software
Greenshift – animation and page builder blocks [greenshift-animation-and-page-builder-blocks]
Researcher
Affected Software
Greenshift – animation and page builder blocks [greenshift-animation-and-page-builder-blocks]
Researcher
Affected Software
GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor [gutenkit-blocks-addon]
Affected Software
Joli Table Of Contents [joli-table-of-contents]
Researcher
Affected Software
Kalles Addons [kalles-addons]
Researcher
Affected Software
Researcher
Affected Software
Live Composer – Free WordPress Website Builder [live-composer-page-builder]
Researcher
Affected Software
Live Composer – Free WordPress Website Builder [live-composer-page-builder]
Researcher
Affected Software
Live Composer – Free WordPress Website Builder [live-composer-page-builder]
Researcher
Affected Software
Live Composer – Free WordPress Website Builder [live-composer-page-builder]
Researcher
Affected Software
Login With Ajax – Fast Logins, 2FA, Redirects [login-with-ajax]
Researcher
Affected Software
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates [learning-management-system]
Researcher
Affected Software
Ninja Forms – Scheduled Exports [ninja-forms-scheduled-exports]
Researcher
Affected Software
Researcher
Affected Software
Powerkit – Supercharge your WordPress Site [powerkit]
Researcher
Affected Software
Product Variations Swatches for WooCommerce [product-variations-swatches-for-woocommerce]
Researcher
Affected Software
SEOPress – AI SEO Plugin & On-site SEO [wp-seopress]
Researcher
Affected Software
Social Chat – Click To Chat App Button [wp-whatsapp-chat]
Researcher
Affected Software
Social Media Share Buttons & Social Sharing Icons [ultimate-social-media-icons]
Researcher
Affected Software
Ultimate Before After Image Slider & Gallery – BEAF [beaf-before-and-after-gallery]
Researcher
Affected Software
Ultimate Before After Image Slider & Gallery – BEAF [beaf-before-and-after-gallery]
Researcher
Affected Software
Researcher
Affected Software
VikWidgetsLoader – Collection of Widgets [vikwidgetsloader]
Researcher
Affected Software
WCFM Marketplace – Multivendor Marketplace for WooCommerce [wc-multivendor-marketplace]
Researcher
Affected Software
Woodmart [woodmart]
Researcher
Affected Software
WP Recipe Maker Premium [wp-recipe-maker-premium]
Researcher
Affected Software
WPBakery Page Builder [js_composer]
Researcher
WPKoi Templates for Elementor <= 3.7.2 – Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
WPKoi Templates for Elementor [wpkoi-templates-for-elementor]
Researcher
Affected Software
Researcher
Affected Software
Bricksforge [bricksforge]
Researcher
Affected Software
Researcher
Affected Software
Theme My Login [theme-my-login]
Researcher
Affected Software
WCFM Membership – WooCommerce Memberships for Multivendor Marketplace [wc-multivendor-membership]
Researcher
Affected Software
Accept Stripe Payments [stripe-payments]
Researcher
Affected Software
Beaver Builder Plugin (Starter Version) [bb-plugin]
Researcher
Affected Software
MapGeo – Interactive Geo Maps [interactive-geo-maps]
Researcher
Photo Gallery by 10Web – Mobile-Friendly Image Gallery < 1.8.44 – Reflected Cross-Site Scripting
6.1
Affected Software
Photo Gallery by 10Web – Mobile-Friendly Image Gallery [photo-gallery]
Researcher
Affected Software
Social Media Share Buttons & Social Sharing Icons [ultimate-social-media-icons]
Researcher
Affected Software
Unlimited Elements For Elementor [unlimited-elements-for-elementor]
Researcher
User Profile Builder <= 4.0.0 – Unauthenticated Stored Cross-Site Scripting via ’email’ Parameter
6.1
Affected Software
Researcher
Affected Software
Broken Link Checker [broken-link-checker]
Researcher
Affected Software
Events Manager – Calendar, Bookings, Tickets, and more! [events-manager]
Researcher
Affected Software
LearnDash LMS [sfwd-lms]
Researcher
Affected Software
Accept Stripe Payments [stripe-payments]
Researcher
Affected Software
B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More [b2bking-wholesale-for-woocommerce]
Researcher
Affected Software
bbPress [bbpress]
Researcher
Affected Software
Booking for Appointments and Events Calendar – Amelia [ameliabooking]
Researcher
Affected Software
Researcher
Patch Status
Patched
Patched
Published
Aug 31, 2026
Aug 31, 2026
Affected Software
Breakdance [breakdance]
Researcher
Affected Software
Business Directory Plugin – Easy Listing & Member Directories for WordPress [business-directory-plugin]
Researcher
Affected Software
Business Directory Plugin – Easy Listing & Member Directories for WordPress [business-directory-plugin]
Researcher
Affected Software
CatalogX – Catalog Mode, Enquiry & Quotes for WooCommerce [woocommerce-catalog-enquiry]
Researcher
Affected Software
Content Views – Post Grid & Filter (Shortcode, Blocks, Elementor Widgets) [content-views-query-and-display-post-page]
Researcher
Affected Software
Researcher
Affected Software
E-cab Taxi Booking Manager for Woocommerce [ecab-taxi-booking-manager]
Researcher
Affected Software
Researcher
Affected Software
ePayco plugin for WooCommerce [epayco-gateway]
Researcher
Affected Software
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution]
Researcher
Affected Software
WP Express Checkout (Fast Payments via PayPal & Stripe) [wp-express-checkout]
Researcher
Affected Software
Fluent Booking Pro [fluent-booking-pro]
Researcher
Affected Software
FormLayer [formlayer]
Researcher
HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 – Unauthenticated Information Exposure
5.3
Affected Software
HEL Online Classroom: AI-powered Online Classrooms [hel-online-classroom]
Researcher
Affected Software
JetFormBuilder — Dynamic Blocks Form Builder [jetformbuilder]
Researcher
Patch Status
Patched
Patched
Published
Sep 3, 2026
Sep 3, 2026
Affected Software
JetFormBuilder — Dynamic Blocks Form Builder [jetformbuilder]
Researcher
Affected Software
KP Agent Ready [kp-agent-ready]
Researcher
Affected Software
Researcher
Masteriyo LMS <= 2.2.0 – Missing Authorization to Unauthenticated Arbitrary Course Progress Deletion
5.3
Affected Software
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates [learning-management-system]
Researcher
MasterStudy LMS WordPress Plugin – for Online Courses and Education < 3.7.46 – Missing Authorization
5.3
Affected Software
MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system]
Researcher
Affected Software
MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system]
Researcher
Affected Software
MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system]
Researcher
Affected Software
MotoPress Appointment Booking [motopress-appointment-lite]
Researcher
Affected Software
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions [dc-woocommerce-multi-vendor]
Researcher
Affected Software
My Private Site – Make Your Whole Site Private, Force Login & Block Registration Spam [jonradio-private-site]
Researcher
Affected Software
Researcher
Affected Software
Pre-Orders for WooCommerce [pre-orders-for-woocommerce]
Researcher
Affected Software
Product Attachment for WooCommerce [woo-product-attachment]
Researcher
Affected Software
PublishPress Permissions: Access Control, Content Permissions, User Access [press-permit-core]
Researcher
Affected Software
Quick Event Manager [quick-event-manager]
Researcher
Affected Software
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings [seo-by-rank-math]
Researcher
Affected Software
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings [seo-by-rank-math]
Researcher
Affected Software
Researcher
Affected Software
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login [custom-registration-form-builder-with-submission-manager]
Researcher
Affected Software
RentSyst – CRM solution for fleet management [rentsyst]
Researcher
Affected Software
Restaurant Menu and Food Ordering [mp-restaurant-menu]
Researcher
Affected Software
Simple Membership [simple-membership]
Researcher
Affected Software
Researcher
Affected Software
Solace Extra [solace-extra]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Ultimate Gift Cards for WooCommerce [woo-gift-cards-lite]
Researcher
Affected Software
Ultimate Maps by Supsystic [ultimate-maps-by-supsystic]
Researcher
Affected Software
Researchers
Affected Software
Unlimited Elements For Elementor [unlimited-elements-for-elementor]
Researcher
Affected Software
Researcher
Affected Software
WCFM Membership – WooCommerce Memberships for Multivendor Marketplace [wc-multivendor-membership]
Researcher
Affected Software
WP Compress – Instant Performance & Speed Optimization [wp-compress-image-optimizer]
Researcher
WP Easy Pay – Payment and Donation Form Builder for Square <= 4.5.3 – Unauthenticated Payment Bypass
5.3
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Xpro Addons — 150+ Widgets for Elementor [xpro-elementor-addons]
Researcher
Affected Software
YITH Request a Quote for WooCommerce [yith-woocommerce-request-a-quote-premium]
Researcher
Divi <= 4.27.6 – Authenticated (Contributor+) Server-Side Request Forgery via ‘image_src’ Parameter
5.0
Affected Software
Divi [Divi]
Researcher
Affected Software
JCH Optimize [jch-optimize]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Photo Gallery by Ays – Responsive Image Gallery [gallery-photo-gallery]
Researcher
Affected Software
Shopping Cart & eCommerce Store [wp-easycart]
Researcher
Affected Software
WooCommerce [woocommerce]
Researcher
Affected Software
Researcher
Affected Software
WPvivid — Backup, Migration & Staging [wpvivid-backuprestore]
Researcher
Joli Table Of Contents 2.0.0 – 2.8.0 – Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
Affected Software
Joli Table Of Contents [joli-table-of-contents]
Researcher
Affected Software
Activity Log – Monitor User and Agent Changes [aryo-activity-log]
Researcher
Affected Software
Agentimus – AI SEO, llms.txt & MCP for AI Agents [agentimus]
Researcher
Classified Listing – AI-Powered Classified ads & Business Directory <= 6.1.2 – Missing Authorization
4.3
Affected Software
Classified Listing – AI-Powered Classified ads & Business Directory [classified-listing]
Researcher
Affected Software
Classified Listing – AI-Powered Classified ads & Business Directory [classified-listing]
Researcher
Affected Software
Custom Contact Forms [custom-contact-forms]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution]
Researcher
Affected Software
Researcher
Affected Software
Grand Tour | Travel Agency WordPress [grandtour]
Researcher
Affected Software
Researcher
Affected Software
JetStyleManager for Gutenberg [jet-style-manager]
Researcher
Affected Software
Researcher
Affected Software
Mang Board WP [mangboard]
Researcher
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution <= 2.1.60 – Missing Authorization
4.3
Affected Software
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution [marketking-multivendor-marketplace-for-woocommerce]
Researcher
Affected Software
MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system]
Researcher
Affected Software
MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system]
Researcher
Affected Software
MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system]
Researcher
Affected Software
MountDev AI MCP Connector for WordPress [mountdev-ai-mcp-connector]
Researcher
Affected Software
Ninja Forms – Save Progress [ninja-forms-save-progress]
Researcher
Affected Software
Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce [a4-barcode-generator]
Researcher
Affected Software
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings [seo-by-rank-math]
Researcher
Affected Software
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings [seo-by-rank-math]
Researcher
Affected Software
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings [seo-by-rank-math]
Researcher
Affected Software
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings [seo-by-rank-math]
Researcher
Affected Software
Researcher
Affected Software
Simply Schedule Appointments [simply-schedule-appointments]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
The Events Calendar [the-events-calendar]
Researcher
Affected Software
Theme My Login [theme-my-login]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.
This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
The post Wordfence Intelligence Weekly WordPress Vulnerability Report (August 31, 2026 to September 6, 2026) appeared first on Wordfence.