Last week, there were 655 vulnerabilities disclosed in 406 WordPress Plugins and 100 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 236 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.
Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, and webhook integration are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back.
Enterprises, Hosting Providers, and even Individuals can utilize the vulnerability Database API to receive a complete dump of our database of over 40,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
New Firewall Rules Deployed Last Week
The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.
The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:
- WordPress Core 7.1 – 7.1.2 – Unauthenticated Stored Cross-Site Scripting via Pending Comments
- Abandoned Cart Pro for WooCommerce <= 10.8.0 – Unauthenticated SQL Injection via Guest Persistent Cart meta_value
Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.
Total Unpatched & Patched Vulnerabilities Last Week
| Patch Status | Number of Vulnerabilities |
|---|---|
| Patched | 366 |
| Unpatched | 289 |
Total Vulnerabilities by CVSS Severity Last Week
| Severity Rating | Number of Vulnerabilities |
|---|---|
| Low Severity | 8 |
| Medium Severity | 377 |
| High Severity | 249 |
| Critical Severity | 21 |
Total Vulnerabilities by CWE Type Last Week
| Vulnerability Type by CWE | Number of Vulnerabilities |
|---|---|
| Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) | 198 |
| Missing Authorization | 112 |
| Deserialization of Untrusted Data | 67 |
| Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) | 61 |
| Exposure of Sensitive Information to an Unauthorized Actor | 45 |
| Improper Privilege Management | 30 |
| Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’) | 24 |
| Authorization Bypass Through User-Controlled Key | 21 |
| Unrestricted Upload of File with Dangerous Type | 18 |
| Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) | 15 |
| Improper Control of Generation of Code (‘Code Injection’) | 11 |
| Improper Authentication | 9 |
| Cross-Site Request Forgery (CSRF) | 8 |
| Client-Side Enforcement of Server-Side Security | 7 |
| Incorrect Authorization | 6 |
| Server-Side Request Forgery (SSRF) | 5 |
| Missing Authentication for Critical Function | 3 |
| Uncontrolled Resource Consumption | 3 |
| Authentication Bypass Using an Alternate Path or Channel | 2 |
| Protection Mechanism Failure | 2 |
| Concurrent Execution using Shared Resource with Improper Synchronization (‘Race Condition’) | 1 |
| Files or Directories Accessible to External Parties | 1 |
| Improper Authorization | 1 |
| Improper Input Validation | 1 |
| Improper Neutralization of Special Elements in Output Used by a Downstream Component (‘Injection’) | 1 |
| Insertion of Sensitive Information Into Sent Data | 1 |
| Loop with Unreachable Exit Condition (‘Infinite Loop’) | 1 |
| Use of Cache Containing Sensitive Information | 1 |
Researchers That Contributed to WordPress Security Last Week
| Researcher Name | Number of Vulnerabilities |
|---|---|
| 61 | |
| 42 | |
| 26 | |
| 26 | |
| 19 | |
| 18 | |
| 16 | |
| 16 | |
| 15 | |
| 13 | |
| 12 | |
| 10 | |
| 8 | |
| 7 | |
| 7 | |
| 7 | |
| 7 | |
| 7 | |
| 6 | |
| 6 | |
| 6 | |
| 6 | |
| 6 | |
| 6 | |
| 6 | |
| 5 | |
| 5 | |
| 5 | |
| 5 | |
| 4 | |
| 4 | |
| 4 | |
| 4 | |
| 4 | |
| 4 | |
| 4 | |
| 4 | |
| 4 | |
| 4 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.
WordPress Plugins with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| 10Web Booster – Website speed optimization, Cache & Page Speed optimizer | tenweb-speed-optimizer |
| 10WebSocial | wd-instagram-feed |
| 3D Product configurator for WooCommerce | expivi |
| aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder | ablocks |
| Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning | academy |
| Accept PayPal Payments using Contact Form 7 | contact-form-7-paypal-extension |
| ACPT (Premium) | advanced-custom-post-type |
| AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress | acymailing |
| Additional Order Filters for WooCommerce | additional-order-filters-for-woocommerce |
| Advanced Classifieds & Directory Pro | advanced-classifieds-and-directory-pro |
| Advanced Form Integration — Connect Forms to 300+ Apps | advanced-form-integration |
| Advanced Google reCAPTCHA | advanced-google-recaptcha |
| Advanced IP Blocker | advanced-ip-blocker |
| Advanced Posts Listing – Show Post List Easily | advanced-posts-listing |
| Adwised Web Push Notification | adwised |
| AFFI – Affiliate Marketing for WooCommerce | affi-affiliate-marketing-for-woo |
| affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display | affiliate-toolkit-starter |
| AI Content Generator Marketing | ai-content-generator-marketing |
| AI Copilot – Content Generator | ai-copilot-content-generator |
| AI Puffer – MCP, AI Chatbot & Content Automation | gpt3-ai-content-generator |
| Airwallex Online Payments Gateway | airwallex-online-payments-gateway |
| ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce | woo-alidropship |
| All Bootstrap Blocks | all-bootstrap-blocks |
| Animated Number Counters | animated-number-counters |
| Ansar Import – One Click Starter Sites – for WordPress Themes | ansar-import |
| Anton Extensions | 4nton-extensions |
| App for Cloudflare® | app-for-cf |
| Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress | latepoint |
| Appointment Bookings for Zoom GoogleMeet and more – Wappointment | wappointment |
| ARforms | arforms |
| ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup | armember |
| Asgaros Forum | asgaros-forum |
| ASPL Product Quotation | aspl-product-quotation |
| Aurora Heatmap | aurora-heatmap |
| AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI | automatorwp |
| AutoPoly – AI Translation For Polylang | automatic-translations-for-polylang |
| Autoship Cloud for WooCommerce Subscription Products | autoship-cloud |
| Avada (Fusion) Builder | fusion-builder |
| AWP Classifieds | another-wordpress-classifieds-plugin |
| BackWPup – WordPress Backup & Restore Plugin | backwpup |
| Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale) | barcode-scanner-lite-pos-to-manage-products-inventory-and-orders |
| Bayarcash WooCommerce | bayarcash-wc |
| bBlocks – Essential Gutenberg Blocks & Patterns Collection | b-blocks |
| Before After Image Comparison – Visual Comparison for Two Images | before-after-image-compare |
| Blocksy Companion | blocksy-companion |
| Blog, Posts and Category Filter for Elementor | blog-posts-and-category-for-elementor |
| Booking Calendar | booking |
| Booking Package | booking-package |
| Booknetic | booknetic |
| Booktics – Appointment Booking Calendar for Service Businesses | booktics |
| Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools | woocommerce-jetpack |
| Bricksforge | bricksforge |
| Brizy – Page Builder | brizy |
| BuddyBoss Platform | buddyboss-platform |
| BuddyPress Instant Chat | bp-instant-chat |
| Builderius – Landing Page Builder + Dynamic Templates | builderius |
| Captcha by BestWebSoft – Advanced Spam Protection, Math & OCR-Friendly Captcha for Site Forms | captcha-bws |
| CF7 Views – Complete Entry Management for Contact Form 7 | cf7-views |
| Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) | charitable |
| Church Admin | church-admin |
| click5 CRM add-on to Contact Form 7 | cf7-add-on-by-click5 |
| click5 CRM add-on to Gravity Forms | gf-add-on-by-click5 |
| click5 CRM add-on to Ninja Forms | click5-crm-add-on-to-ninja-forms |
| click5 CRM add-on to WPForms | wpf-add-on-by-click5 |
| Code Snippets | code-snippets |
| CodeBard Help Desk | codebard-help-desk |
| Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress | contact-form-to-db |
| Content Visibility for Divi Builder | content-visibility-for-divi-builder |
| Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe | contest-gallery |
| CP Media Player – Audio Player and Video Player | audio-and-video-player |
| Creator LMS – WordPress LMS Plugin for Coaches, Cohorts & Course Creators | creatorlms |
| Crowdfundly | crowdfundly |
| CURCY – Multi Currency for WooCommerce | woo-multi-currency |
| Dashboard Notes | dashboard-notes |
| Data Tables Generator by Supsystic | data-tables-generator-by-supsystic |
| Database Addon For WPForms ( wpforms entries ) – WPFormsDB | database-for-wpforms |
| Database for CF7 | database-for-cf7 |
| Datalist it | datalistit |
| Directory Listings WordPress plugin – uListing | ulisting |
| DirectoryPress – Business Directory And Classified Ad Listing | directorypress |
| Disable Users | disable-users |
| Divi Plus | divi-plus |
| Doctreat Core | doctreat_core |
| Document Embedder – let visitors read files without downloading | document-emberdder |
| Document Gallery | document-gallery |
| Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy | dokan-lite |
| Download Manager | download-manager |
| DTX – Dynamic Text Extension for Contact Form 7 | contact-form-7-dynamic-text-extension |
| Dynamic User Directory | dynamic-user-directory |
| E-cab Taxi Booking Manager for Woocommerce | ecab-taxi-booking-manager |
| Easy Digital Downloads – eCommerce Payments and Subscriptions made easy | easy-digital-downloads |
| eCommerce Product Catalog | ecommerce-product-catalog |
| Edwiser Bridge – WordPress Moodle Integration | edwiser-bridge |
| Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons | bdthemes-element-pack-lite |
| ELEX WooCommerce Bulk Edit Products, Prices & Attributes (Basic) | elex-bulk-edit-products-prices-attributes-for-woocommerce-basic |
| Email Marketing for WordPress and WooCommerce – Retainful | retainful |
| Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files | embed-any-document |
| Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More | envira-gallery-lite |
| eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams | eroom-zoom-meetings-webinar |
| Event Tickets and Registration | event-tickets |
| Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce | wp-event-solution |
| Events Manager – Calendar, Bookings, Tickets, Appointments and more! | events-manager |
| Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin | everest-backup |
| Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) | extensions-for-cf7 |
| Fastcache by Host.it | fastcache-by-host-it |
| Favicon Rotator | favicon-rotator |
| Filter Everything — WordPress & WooCommerce Filters | filter-everything |
| FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment | firebox |
| Fluent Affiliate Pro | fluent-affiliate-pro |
| Fluent Booking Pro | fluent-booking-pro |
| Fluent Forms Pro Add On Pack | fluentformpro |
| Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder | fluentform |
| Food Menu – Restaurant Menu & Online Ordering for WooCommerce | tlp-food-menu |
| FooSales – Point of Sale (POS) for WooCommerce | foosales |
| Form Block | form-block |
| Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder | form-maker |
| Forminator Forms – Contact Form, Payment Form & Custom Form Builder | forminator |
| Freeton WP | freeton-wp |
| Front End PM | front-end-pm |
| Frontend Admin by DynamiApps | acf-frontend-form-element |
| Frontend Dashboard | frontend-dashboard |
| Fundiin cho WooCommerce | fundiin |
| FunnelKit – Funnel Builder Plugin for WooCommerce Checkout | funnel-builder |
| FV Flowplayer Video Player | fv-wordpress-flowplayer |
| FV Player 8 | fv-player |
| Gallery PhotoBlocks | photoblocks-grid-gallery |
| GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI | gamipress |
| GDPR Data Request Form | gdpr-data-request-form |
| Geliver Akıllı Kargo Pazaryeri | geliver-akilli-kargo-pazaryeri |
| GeoDirectory – WP Business Directory Plugin and Classified Listings Directory | geodirectory |
| Getwid – Gutenberg Blocks | getwid |
| GIFT4U – Gift Cards All in One for Woo | gift4u-gift-cards-all-in-one-for-woo |
| GiveWP – Donation Plugin and Fundraising Platform | give |
| Gloria Admin Panel | gloria-admin-panel |
| Gmedia Photo Gallery | grand-media |
| GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI | gptranslate |
| Graphina – Charts and Graphs For Elementor | graphina-elementor-charts-and-graphs |
| Groundhogg — CRM, Newsletters, and Marketing Automation | groundhogg |
| HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates | happy-elementor-addons |
| Hello Plus | hello-plus |
| HireZoot – Job Listings, Career Page & Recruitment Tool | wp-job-openings |
| HivePress – Business Directory, Listings & Classified Ads Plugin | hivepress |
| HollerBox — Fast & Effective Popups & Lead-Generation | holler-box |
| HootBoard – Bulletin Board For Your Organization & Team Communication | hootboard |
| Hotel Booking | nd-booking |
| HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player | html5-audio-player |
| HTTP Requests Manager | http-requests-manager |
| Hustle – Email Marketing, Lead Generation, Optins, Popups | wordpress-popup |
| If-So Dynamic Content – Elementor & All Page Builders Personalization | if-so |
| Image Optimizer, Resizer and CDN – Sirv | sirv |
| Image Photo Gallery Final Tiles Grid | final-tiles-grid-gallery-lite |
| Image Slider | image-slider-widget |
| Import and export users and customers | import-users-from-csv-with-meta |
| Instapage Plugin | instapage |
| Insurify – Order & Shipping Protection | insurify |
| Integration for Epos Now and WooCommerce | woo-epos-now-integration |
| JetBlocks for Elementor | jet-blocks |
| JetElements | jet-elements |
| JetFormBuilder — Dynamic Blocks Form Builder | jetformbuilder |
| Jetpack VideoPress | jetpack-videopress |
| Jetpack – WP Security, Backup, Speed, & Growth | jetpack |
| Job Postings | job-postings |
| Jotform – AI Chatbot | jotform-ai-chatbot |
| JS Help Desk – AI-Powered Support & Ticketing System | js-support-ticket |
| Kadence Blocks — Page Builder Toolkit for Gutenberg Editor | kadence-blocks |
| KeyWord Collector | keyword-collector |
| Kirki – Freeform Page Builder, Website Builder & Customizer | kirki |
| Kit (formerly ConvertKit) for WooCommerce | convertkit-for-woocommerce |
| Koinonia Link | koinonia-link |
| LazyLoad Plugin – Lazy Load Images, Videos, and Iframes | rocket-lazy-load |
| LearnPress – WordPress LMS Plugin for Create and Sell Online Courses | learnpress |
| Leyka | leyka |
| LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes | lifterlms |
| Listdom: AI-powered Business Directory with Classifieds Ads Listings | listdom |
| ListingPro Plugin | listingpro-plugin |
| Livees Checkout | livees-checkout |
| Llavero.io | llavero-io |
| Login Lockdown & Protection | login-lockdown |
| Logo Showcase – Logo Slider, Carousel & Sponsors Gallery | logo-showcase |
| Loja Automática | loja-automatica |
| LTL Freight Quotes – ODFL Edition | ltl-freight-quotes-odfl-edition |
| Magee Shortcodes | magee-shortcodes |
| Mailjet Email Marketing | mailjet-for-wordpress |
| MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites | mainwp-child |
| Mapster WP Maps | mapster-wp-maps |
| MasterStudy LMS WordPress Plugin – for Online Courses and Education | masterstudy-lms-learning-management-system |
| Media Library Assistant | media-library-assistant |
| Memberful – Membership Plugin | memberful-wp |
| MemberHero – Simple User Registration & Login | wp-registration |
| Meta Box AIO | meta-box-aio |
| MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet | paid-membership |
| Midtrans-WooCommerce | midtrans-woocommerce |
| Mindstien Quick Login | mindstien-quick-login |
| miniOrange OTP Login, Verification and SMS Notifications | miniorange-otp-verification |
| Mobile builder | mobile-builder |
| Modula Image Gallery – Photo Grid & Video Gallery | modula-best-grid-gallery |
| Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress | molongui-authorship |
| Morning for WooCommerce | wc-gateway-greeninvoice |
| Motors – Car Dealership & Classified Listings Plugin | motors-car-dealership-classified-listings |
| MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar | mp3-music-player-by-sonaar |
| MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO | multiple-pages-generator-by-porthas |
| MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions | dc-woocommerce-multi-vendor |
| Museder RestoreOne | museder-restoreone |
| Music Store – WordPress eCommerce | music-store |
| Name Directory | name-directory |
| Newsletter Subscription Form – User Subscriptions Form, Capture Email | newsletter-subscription-form |
| Nexi XPay Build | nexi-xpay-build |
| Noptin – Newsletter, New Post Notifications & Email Automation | newsletter-optin-box |
| Norvis Backup | norvis-backup |
| Ocean eComm Treasure Box | ocean-ecommerce |
| Ocean Pro Demos | ocean-pro-demos |
| OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. | host-webfonts-local |
| Online Scheduling and Appointment Booking System – Bookly | bookly-responsive-appointment-booking-tool |
| Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization | optimole-wp |
| Order Export & Order Import for WooCommerce | order-import-export-for-woocommerce |
| Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction | paid-member-subscriptions |
| Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway | cryptocurrency-payments-using-metamask-for-woocommerce |
| payever – WooCommerce Gateway | payever-woocommerce-gateway |
| paymendo – Bank Transfer (Lite) | paymendo-bank-transfer |
| Payment Plugins for Stripe WooCommerce | woo-stripe-payment |
| PayPlug for WooCommerce (Official) | payplug |
| PDF Invoices & Packing Slips for WooCommerce – Challan | webappick-pdf-invoice-for-woocommerce |
| peepso | peepso |
| PeproDev Ultimate Profile Solutions | peprodev-ups |
| Photo Gallery by 10Web – Mobile-Friendly Image Gallery | photo-gallery |
| Photo Reviews for WooCommerce | woo-photo-reviews |
| picu – Online Photo Proofing Gallery | picu |
| Piotnet Addons For Elementor | piotnet-addons-for-elementor |
| Piotnet Forms | piotnetforms |
| Pix por Piggly (para Woocommerce) | pix-por-piggly |
| Podlove Podcast Publisher | podlove-podcasting-plugin-for-wordpress |
| Polylang | polylang |
| Portfolio Filter Gallery – Photo Gallery | portfolio-filter-gallery |
| Porto Theme – Functionality | porto-functionality |
| Post Export Import with Media | post-export-import-with-media |
| Post Grid Gutenberg Blocks – PostX | ultimate-post |
| Post SMTP – Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App | post-smtp |
| Post Snippets – Custom WordPress Code Snippets Customizer | post-snippets |
| Post title marquee scroll | post-title-marquee-scroll |
| Post Voting System | post-voting-system |
| PowerPress Podcasting plugin by Blubrry | powerpress |
| PPOM – Product Addons & Custom Fields for WooCommerce | woocommerce-product-addon |
| Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates | premium-addons-for-elementor |
| Premium Packages – Sell Digital Products Securely | wpdm-premium-packages |
| Prenotazioni | prenotazioni |
| Presto Player | presto-player |
| Presto Player Pro | presto-player-pro |
| Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons | bdthemes-prime-slider-lite |
| Product Configurator for WooCommerce | product-configurator-for-woocommerce |
| Product Designer for WooCommerce WordPress | Lumise | lumise |
| Pubjet | پابجت | pubjet |
| QA Assistants – Driven by data | qa-heatmap-analytics |
| Qode Music | qode-music |
| Qode Real Estate | qode-real-estate |
| Qode Tours | qode-tours |
| QR Redirector | qr-redirector |
| Quick quotes – WPSHARE247 | quick-quotes-wpshare247 |
| Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker | quiz-master-next |
| Radius Booking – Appointment Booking Calendar & Scheduling for Services & Events | radius-booking |
| Rank Math SEO – AI SEO Tools to Dominate SEO Rankings | seo-by-rank-math |
| Real Estate Manager – Property Listing and Agent Management | real-estate-manager |
| Real3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder | real3d-flipbook-lite |
| Recordbrowser | recordbrowser |
| Redux Framework | redux-framework |
| Responsive Lightbox & Gallery | responsive-lightbox |
| Restrict User Access – Ultimate Membership & Content Protection | restrict-user-access |
| Robo Gallery – Photo & Image Slider | robo-gallery |
| RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator | feedzy-rss-feeds |
| rtMedia for WordPress, BuddyPress and bbPress | buddypress-media |
| SafeSnap – Verified WordPress Backup & Restore | safesnap |
| Salon Booking System – Appointment Booking for Salons, Barbershops & Spas | salon-booking-system |
| Scripts n Styles | scripts-n-styles |
| Sell Downloads | sell-downloads |
| SendPress Newsletters | sendpress |
| Shipping for Nova Poshta | nova-poshta-ttn |
| ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF | shortpixel-image-optimiser |
| Simple File List | simple-file-list |
| Simple JWT Login – Allows you to use JWT on REST endpoints. | simple-jwt-login |
| Simple Membership | simple-membership |
| Simply Schedule Appointments | simply-schedule-appointments |
| Site Setup Wizard | site-setup-wizard |
| Sitemovr | sitemovr |
| SiteOrigin Widgets Bundle | so-widgets-bundle |
| SiteVault – Backup, Restore, Migration & Cloning | sitevault-backup-restore-migration |
| SKU Error Fixer for WooCommerce | sku-error-fixer-for-woocommerce |
| Slider by 10Web – Responsive Image Slider | slider-wd |
| Smart Popup by Supsystic | popup-by-supsystic |
| SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery | sms-alert |
| SmugMug Embed | smugmug-embed |
| Snapshotify – All-in-One Backup & Restore & Migrate | snapshotify |
| Social Rocket – Social Sharing Plugin | social-rocket |
| Social Share Icons & Social Share Buttons | ultimate-social-media-plus |
| Social Web Suite – Social Media Auto Post, Social Media Auto Publish | social-web-suite |
| Spam Protection for Forms & Comments. Anti-Spam by CleanTalk | cleantalk-spam-protect |
| SpeedyCache – Cache, Optimization, Performance | speedycache |
| Squadeno – Club Sports Manager | squadeno-club-sports-manager |
| Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg | astra-sites |
| StoreGrowth – Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce | storegrowth-sales-booster |
| StreamCast – bring live radio to your site with a sleek player | streamcast |
| String locator | string-locator |
| Subscribe to Comments | subscribe-to-comments |
| Super Forms – Drag & Drop Form Builder | super-forms |
| Super Payments – WooCommerce Payment Gateway | super-payments |
| Super Video player – Fully Customizable Video Player with Playlist | super-video-player |
| SureDash – Community, Courses & Member Dashboard | suredash |
| Swish Migrate and Backup | swish-migrate-and-backup |
| Table Field Add-on for ACF and SCF | advanced-custom-fields-table-field |
| Tabs Responsive – With WooCommerce Product Tabs Extension | tabs-responsive |
| Tailored Tools | tailored-tools |
| Tainacan | tainacan |
| Taskbot | taskbot |
| Tcard WP | tcard-wp |
| Team Section Block – Showcase Team Members with Layout Options | team-section |
| Team – Team Members Showcase Plugin | tlp-team |
| Testimonials by BestWebSoft | bws-testimonials |
| Thanko Thank You Page Customizer for WooCommerce | woo-thank-you-page-customizer |
| The GDPR Framework By Data443 | gdpr-framework |
| ThemeStek Extras for LabtechCO Theme | themestek-labtechco-extras |
| Tickera – Sell Tickets & Manage Events | tickera-event-ticketing-system |
| Tonda Membership | tonda-membership |
| Topcontent | topcontent |
| Tourfic Pro | tourfic-pro |
| Track Orders for WooCommerce – Multi Carrier WooCommerce Shipping | track-orders-for-woocommerce |
| TrueBooker – Appointment Booking and Scheduler System | truebooker-appointment-booking |
| Tutor LMS – eLearning and online course solution | tutor |
| uDesign | Multipurpose WordPress Theme | u-design-core |
| Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform | ultimate-multisite |
| Ultimate Post Kit – Elementor Post Grid, Post Carousel, Post Slider & Blog Layout Widgets | ultimate-post-kit |
| Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included | uncanny-automator |
| UnitechPay – Wave & Orange Money Payments | unitechpay-paiements-mobile-money |
| Unlimited Elements for Elementor | unlimited-elements-for-elementor |
| Upcasted S3 Offload – AWS S3, DigitalOcean Spaces, Backblaze, MinIO Storage Integration | upcasted-s3-offload |
| User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission | wp-user-frontend |
| User Private Files – Secure File Sharing and Client Portal Plugin | user-private-files |
| Veeqo for WooCommerce | veeqo-for-woocommerce |
| Video Background Block – Add Stunning Video Backgrounds to Any Section | video-background-block |
| Video Conferencing with Zoom | video-conferencing-with-zoom-api |
| VikBooking Hotel Booking Engine & PMS | vikbooking |
| VikRentCar Car Rental Management System | vikrentcar |
| VillaTheme Core | villatheme-core |
| Visual Composer Website Builder | visualcomposer |
| Vitepos – Point of Sale (POS) for WooCommerce | vitepos-lite |
| W3 Total Cache | w3-total-cache |
| Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments | wallet-system-for-woocommerce |
| WC Fields Factory | wc-fields-factory |
| WCFM – Multivendor Marketplace REST API for WooCommerce | wcfm-marketplace-rest-api |
| Web Plura Backup & Restore – Local Backups, Restore & Recovery | web-plura-backup-restore-manager |
| Web Vitals Tracking | web-vitals-tracking |
| WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels | print-invoices-packing-slip-labels-for-woocommerce |
| WeddingCity Lite – Wedding Directory and Listing | weddingcity-lite |
| Wise Chat | wise-chat |
| WooCommerce | woocommerce |
| WooCommerce Bookings | woocommerce-bookings |
| WooCommerce Simple Auctions | woocommerce-simple-auctions |
| Wordable – Export Google Docs to WordPress | wordable |
| Workreap Core | workreap_core |
| WP 2FA – Two-factor authentication for WordPress | wp-2fa |
| WP Admin Audit | wp-admin-audit |
| WP Associate Post R2 | wp-associate-post-r2 |
| WP Booking System – Booking Calendar | wp-booking-system |
| WP Coder – Insert & Manage Code Snippets | wp-coder |
| WP Comment Cleaner – Delete All Comments, Disable Comments, Bulk Delete & Remove Comments | delete-all-comments-of-website |
| WP CV Builder | cv-builder |
| WP Directory Kit | wpdirectorykit |
| WP Dummy Content Generator | wp-dummy-content-generator |
| WP Duplicate – WordPress Migration Plugin | local-sync |
| WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce | wp-event-manager |
| WP File Download | wp-file-download |
| WP Mailster | wp-mailster |
| WP Meteor Website Speed Optimization Addon | wp-meteor |
| WP Photo Album Plus | wp-photo-album-plus |
| WP Plugin Info Card | wp-plugin-info-card |
| WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars | wp-post-author |
| WP Posts Password Batch Manager | wp-posts-password-batch-manager |
| WP Rocket | wp-rocket |
| WP Rollback – Rollback Plugins and Themes | wp-rollback |
| WP Store Locator | wp-store-locator |
| WP Synchro – The Ultimate WordPress Migration Tool | wpsynchro |
| WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export | wp-ultimate-csv-importer |
| WP User Profiles | wp-user-profiles |
| WP Verify API | wp-verify-api |
| WP-Invoice – Web Invoice and Billing | wp-invoice |
| WP-Partner | wp-partner |
| WP2LEADS | WordPress und KlickTipp einfach verbinden – WooCommerce und KlickTipp einfach verbinden | wp2leads |
| WPAdverts – Classifieds Plugin | wpadverts |
| WPBase Cache | wpbase-cache |
| WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System | wp-cafe |
| WPCOM Member | wpcom-member |
| WPComplete | wpcomplete |
| WpCues Basic Quiz | wpcues-basic-quiz |
| WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More | wpforms-lite |
| WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell | wpfunnels |
| WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode | gdpr-cookie-consent |
| WPML Multilingual & Multicurrency for WooCommerce | woocommerce-multilingual |
| WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) | wpo365-login |
| wpsection | wpsection |
| WPVR – 360 Panorama viewer and Virtual Tour Builder for WordPress | wpvr |
| WXD Backup Lite | wxd-backup-lite |
| XServer Migrator | xserver-migrator |
| Yaad Sarig Payment Gateway For WC | yaad-sarig-payment-gateway-for-wc |
| YITH WooCommerce Affiliates | yith-woocommerce-affiliates |
| YITH WooCommerce Product Add-Ons | yith-woocommerce-product-add-ons |
| YITH WooCommerce Product Bundles | yith-woocommerce-product-bundles |
| Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress | youzify |
| Zero Spam for WordPress | zero-spam |
| Zotpress | zotpress |
WordPress Themes with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| Aalto – Architecture and Interior Design WordPress Theme | aalto |
| Alliance | Intranet & Extranet BuddyPress WordPress Theme | alliance |
| Ambed – Wallpapers & Painting Services WordPress Theme | ambed |
| Ambient – Modern Interior Design and Decoration WordPress Theme | ambient |
| Anesta – Intranet, Extranet, Community and BuddyPress WordPress Theme | anesta |
| Angio – Creative Music Theme | angio |
| Armania – Fashion, Furniture, Organic, Food Multipurpose Elementor WooCommerce Theme (RTL Supported) | armania |
| asia-garden | asia-garden |
| Avada | Website Builder For WordPress & WooCommerce | Avada |
| Avala – Wedding & Event WordPress Theme | avala |
| Backhoe – Construction Equipment Rentals WordPress Theme | backhoe |
| Balance | balance |
| Biolife – Organic Food WordPress Theme ( RTL Supported ) | biolife |
| Booklovers – Publishing House, Bookshop & BookStore WordPress Theme + RTL | booklovers |
| Boutique – Kute Fashion WooCommerce Theme ( RTL Supported ) | kute-boutique |
| Buzz Stone | Magazine & Viral Blog WordPress Theme | buzzstone |
| Camelia | Floral Studio Florist WordPress Theme | camelia |
| Cardea – Portfolio One Page WordPress Theme | cardea-wp |
| CleanSkin | Handmade Organic Soap & Natural Cosmetics Shop WordPress Theme + Elementor | cleanskin |
| colorit | colorit |
| Convex – Architecture & Interior Design WordPress Theme | convex |
| DK | dk |
| Doctreat – Hospitals and Doctors Directory WordPress Listing Theme | doctreat |
| Drone Media | Aerial Photography & Videography Theme | drone-media |
| Duka Market – Multipurpose eCommerce Template | dukamarket |
| Dwell – Building, Construction & Renovation Theme | dwell |
| Edema | Wellness & Spa WordPress Theme | edema |
| Education Center | LMS & Online Courses WordPress Theme | education |
| Educavo – Education WordPress Theme | educavo |
| EduMall – Professional LMS Education Center WordPress Theme | edumall |
| Equadio | equadio |
| Fabius – One Page Resume WordPress Theme | fabius-wp |
| FC United | Football, Soccer & Sports WordPress Theme + Events & Shop | fcunited |
| Flipmart – MegaOne Multipurpose WordPress Theme | flipmart |
| FoodBakery | Food Delivery Single & Multiple Restaurant Template | foodbakery |
| grandnews | grandnews |
| Graphene | graphene |
| Greeny – Electric Car Dealership WordPress Theme | greeny |
| Grocery Shopping Store | grocery-shopping-store |
| Gutentype | 100% Gutenberg Blog Theme + Elementor | gutentype |
| Hogwords | School, University Education WordPress Theme | hogwords |
| Hygia – Cleaning Services WordPress Theme | hygia |
| Invetex | invetex |
| iPharm – Online Pharmacy Woocommerce Elementor Template Kit | ipharm |
| jacqueline | jacqueline |
| Jannah – Newspaper Magazine News BuddyPress AMP | jannah |
| JobZilla – Job Board WordPress Theme | jobzilla |
| Juno | Kids Toys & Games Store WordPress Theme | junotoys |
| Kalles – Clean, Versatile, Responsive Shopify Theme – RTL support | kalles |
| Kaven – Business One Page WordPress Theme | kaven-wp |
| Kicker – Blog Magazine Theme | kicker |
| Kids Planet – Children Kindergarten and Playgroup WordPress Theme | kidsplanet |
| kidscare | kidscare |
| kuteshop | kuteshop |
| Law Office | law-office |
| Let’s Play | Hockey School & Winter Sports WordPress Theme | playhockey |
| LMS – Education WordPress Theme | lms |
| Martfury – Marketplace Mobile App Figma Template | martfury |
| Motors – Car Dealer, Rental & Listing WordPress theme | motors |
| N7 | n7-golf-club |
| Neo | Barber Shop WordPress Theme | neocut |
| Ogency – Web Design Agency WordPress Theme | ogency |
| Original | original |
| Ozeum | Art Gallery and Museum Theme | ozeum |
| Partiso | Political Party & Candidate Elementor Template Kit | partiso |
| Photolia | Photo Company & Supply Store WordPress Theme | photolia |
| Pin = Pinterest Style / Personal Masonry Blog / Front-end Submission | pin-wp |
| Qwery – Multi-Purpose Business WordPress & WooCommerce Theme + ChatGPT | qwery |
| Rosalinda | Health Coach & Vegetarian Lifestyle WordPress Theme | rosalinda |
| ShiftCV – Blog Resume Portfolio WordPress Theme | shift-cv |
| Smart Casa | Home Automation & House Technologies WordPress Theme | smart-casa |
| Smash – Tennis WordPress Theme | smash |
| Splendour | splendour |
| Stargaze | stargaze |
| Tantra | Yoga Studio and Fitness Club WordPress Theme | tantra |
| TechOne – Electronics Multipurpose WooCommerce Theme ( RTL Supported ) | techone |
| Teoro – One Page WordPress Theme | teoro-wp |
| Th Shop Mania | th-shop-mania |
| The Voux – A Multipurpose News & Magazine WordPress Theme | thevoux-wp |
| The7 — Website and eCommerce Builder for WordPress | dt-the7 |
| tipsy | tipsy |
| TouchUp – Cosmetic and Plastic Surgery WordPress Theme | touchup |
| Travel Booking WordPress Theme | traveler |
| Travesia | Travel Agency and Tour Booking WordPress Theme | travesia |
| Treck – Immigration and Visa Consulting WordPress Theme | treck |
| TutorStarter | tutorstarter |
| Uminex – Multipurpose WooCommerce Theme | uminex |
| Veto – Politics, Campaign & Candidate WordPress Theme | veto |
| Voldor – Welding & Metal Work WordPress Theme | voldor |
| Volos – One Page Resume WordPress Theme | volos-wp |
| Werkstatt – Creative Portfolio WordPress Theme | werkstatt |
| Whistle – Sports Clothing & Fitness Equipment | whistle-sports-club |
| Windsor – Apartment Complex Single Property WordPress Theme | windsor |
| Wine House | Winery & Restaurant WordPress Theme | wine-house |
| WineShop – Food & Wine Store WordPress Theme | wineshop |
| Woffice CRM | woffice |
| WP Rentals – Booking Accommodation WordPress Theme | wprentals |
| WPLMS Learning Management System for WordPress, WordPress LMS | wplms |
| Yacht Rental – Boat Services WordPress Theme | yacht-rental |
| Zeinet – Internet Provider & Satellite TV | zeinet |
Vulnerability Details
Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.
Affected Software
Researcher
Affected Software
Advanced IP Blocker [advanced-ip-blocker]
Researcher
Affected Software
Anton Extensions [4nton-extensions]
Bricksforge <= 3.1.8.9 – Unauthenticated Arbitrary File Upload via ‘temporaryFileUploads’ Parameter
9.8
Affected Software
Bricksforge [bricksforge]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) [extensions-for-cf7]
Researcher
Affected Software
Freeton WP [freeton-wp]
Researcher
Affected Software
Mindstien Quick Login [mindstien-quick-login]
Researcher
SiteVault – Backup, Restore, Migration & Cloning <= 1.5.19 – Unauthenticated Remote Code Execution
9.8
Affected Software
SiteVault – Backup, Restore, Migration & Cloning [sitevault-backup-restore-migration]
Researcher
Affected Software
Researcher
Affected Software
Tailored Tools [tailored-tools]
Researcher
Affected Software
Tonda Membership [tonda-membership]
Researcher
Affected Software
Tourfic Pro [tourfic-pro]
Researcher
Affected Software
WPCOM Member [wpcom-member]
Researcher
Affected Software
Avada (Fusion) Builder [fusion-builder]
Researchers
Affected Software
Blocksy Companion [blocksy-companion]
Researcher
Affected Software
PPOM – Product Addons & Custom Fields for WooCommerce [woocommerce-product-addon]
Researcher
rtMedia for WordPress, BuddyPress and bbPress <= 4.7.13 – Unauthenticated Arbitrary File Deletion
9.1
Affected Software
rtMedia for WordPress, BuddyPress and bbPress [buddypress-media]
Researcher
Affected Software
Simple File List [simple-file-list]
Researcher
Affected Software
Super Forms – Drag & Drop Form Builder [super-forms]
Researcher
Affected Software
ACPT (Premium) [advanced-custom-post-type]
Researcher
Affected Software
Researcher
Affected Software
CodeBard Help Desk [codebard-help-desk]
Researcher
Content Visibility for Divi Builder <= 5.03 – Authenticated (Contributor+) Remote Code Execution
8.8
Affected Software
Content Visibility for Divi Builder [content-visibility-for-divi-builder]
Researcher
Affected Software
Researcher
Affected Software
Crowdfundly [crowdfundly]
Researcher
Affected Software
Researcher
Affected Software
FV Player 8 [fv-player]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Super Forms – Drag & Drop Form Builder [super-forms]
Researcher
Affected Software
Taskbot [taskbot]
Researcher
Affected Software
Veeqo for WooCommerce [veeqo-for-woocommerce]
Researcher
Affected Software
Workreap Core [workreap_core]
Researcher
Affected Software
WP Duplicate – WordPress Migration Plugin [local-sync]
Researcher
Affected Software
Researcher
Affected Software
Advanced Form Integration — Connect Forms to 300+ Apps [advanced-form-integration]
Researcher
Affected Software
AFFI – Affiliate Marketing for WooCommerce [affi-affiliate-marketing-for-woo]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
asia-garden [asia-garden]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools [woocommerce-jetpack]
Researcher
Affected Software
Boutique – Kute Fashion WooCommerce Theme ( RTL Supported ) [kute-boutique]
Researcher
Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 – Unauthenticated PHP Object Injection
8.1
Affected Software
Researcher
Camelia | Floral Studio Florist WordPress Theme <= 1.2.15 – Unauthenticated PHP Object Injection
8.1
Affected Software
Researcher
Affected Software
Cardea – Portfolio One Page WordPress Theme [cardea-wp]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
DirectoryPress – Business Directory And Classified Ad Listing [directorypress]
Researcher
Drone Media | Aerial Photography & Videography Theme <= 2.2.0 – Unauthenticated PHP Object Injection
8.1
Affected Software
Drone Media | Aerial Photography & Videography Theme [drone-media]
Researcher
Affected Software
Duka Market – Multipurpose eCommerce Template [dukamarket]
Researcher
Dwell – Building, Construction & Renovation Theme <= 1.16.0 – Unauthenticated PHP Object Injection
8.1
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Fabius – One Page Resume WordPress Theme [fabius-wp]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Greeny – Electric Car Dealership WordPress Theme <= 2.10.0 – Unauthenticated PHP Object Injection
8.1
Affected Software
Researcher
Affected Software
Researcher
Gutentype | 100% Gutenberg Blog Theme + Elementor <= 2.1.12 – Unauthenticated PHP Object Injection
8.1
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
jacqueline [jacqueline]
Researcher
Affected Software
Job Postings [job-postings]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Kaven – Business One Page WordPress Theme [kaven-wp]
Researcher
Affected Software
Kicker – Blog Magazine Theme [kicker]
Researcher
Affected Software
kidscare [kidscare]
Researcher
Affected Software
kuteshop [kuteshop]
Researcher
Affected Software
Law Office [law-office]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
payever – WooCommerce Gateway [payever-woocommerce-gateway]
Researcher
Affected Software
peepso [peepso]
Researcher
Affected Software
Researcher
Affected Software
Presto Player Pro [presto-player-pro]
Researcher
Affected Software
Researcher
Affected Software
Researcher
ShiftCV – Blog Resume Portfolio WordPress Theme <= 3.0.14 – Unauthenticated PHP Object Injection
8.1
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Smash – Tennis WordPress Theme [smash]
Researcher
Affected Software
String locator [string-locator]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Teoro – One Page WordPress Theme [teoro-wp]
Researcher
Affected Software
The GDPR Framework By Data443 [gdpr-framework]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Volos – One Page Resume WordPress Theme [volos-wp]
Researcher
Affected Software
Werkstatt – Creative Portfolio WordPress Theme [werkstatt]
Researcher
Affected Software
Researcher
Affected Software
Wine House | Winery & Restaurant WordPress Theme [wine-house]
Researcher
Affected Software
WineShop – Food & Wine Store WordPress Theme [wineshop]
Researcher
Affected Software
WP File Download [wp-file-download]
Researcher
Affected Software
Researcher
Affected Software
Yacht Rental – Boat Services WordPress Theme [yacht-rental]
Researcher
Affected Software
Angio – Creative Music Theme [angio]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
ASPL Product Quotation [aspl-product-quotation]
Researcher
Affected Software
colorit [colorit]
Researcher
Affected Software
Datalist it [datalistit]
Researcher
Affected Software
Researcher
Affected Software
Dynamic User Directory [dynamic-user-directory]
Researcher
Affected Software
Gmedia Photo Gallery [grand-media]
Researcher
Affected Software
Llavero.io [llavero-io]
Researcher
Affected Software
Loja Automática [loja-automatica]
Researcher
Affected Software
LTL Freight Quotes – ODFL Edition [ltl-freight-quotes-odfl-edition]
Researcher
Affected Software
Mobile builder [mobile-builder]
Researcher
Patch Status
Patched
Patched
Published
Oct 9, 2026
Oct 9, 2026
Affected Software
Music Store – WordPress eCommerce [music-store]
Researcher
Affected Software
Neo | Barber Shop WordPress Theme [neocut]
Researcher
Affected Software
Newsletter Subscription Form – User Subscriptions Form, Capture Email [newsletter-subscription-form]
Researcher
Affected Software
paymendo – Bank Transfer (Lite) [paymendo-bank-transfer]
Researcher
Affected Software
Porto Theme – Functionality [porto-functionality]
Researcher
Affected Software
Post Voting System [post-voting-system]
Researcher
Affected Software
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker [quiz-master-next]
Researcher
Affected Software
Researcher
Affected Software
Recordbrowser [recordbrowser]
Researcher
Affected Software
rtMedia for WordPress, BuddyPress and bbPress [buddypress-media]
Researcher
Affected Software
SendPress Newsletters [sendpress]
Researcher
Affected Software
Site Setup Wizard [site-setup-wizard]
Researcher
Affected Software
Slider by 10Web – Responsive Image Slider [slider-wd]
Researcher
Affected Software
Social Web Suite – Social Media Auto Post, Social Media Auto Publish [social-web-suite]
Researcher
Affected Software
Tainacan [tainacan]
Researcher
Affected Software
Tcard WP [tcard-wp]
Researcher
Affected Software
Testimonials by BestWebSoft [bws-testimonials]
Researcher
Affected Software
Tickera – Sell Tickets & Manage Events [tickera-event-ticketing-system]
Researcher
Affected Software
Travel Booking WordPress Theme [traveler]
Researcher
Affected Software
Researcher
Affected Software
WP Verify API [wp-verify-api]
Researcher
Affected Software
WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels [print-invoices-packing-slip-labels-for-woocommerce]
Researcher
Affected Software
WP-Partner [wp-partner]
Researcher
Affected Software
WpCues Basic Quiz [wpcues-basic-quiz]
Researcher
Affected Software
AI Content Generator Marketing [ai-content-generator-marketing]
Researcher
Affected Software
Doctreat Core [doctreat_core]
Researcher
Affected Software
Researcher
Affected Software
Frontend Dashboard [frontend-dashboard]
Researcher
GiveWP – Donation Plugin and Fundraising Platform <= 4.17.0 – Unauthenticated Privilege Escalation
7.3
Affected Software
Researcher
Affected Software
Meta Box AIO [meta-box-aio]
Researcher
Affected Software
miniOrange OTP Login, Verification and SMS Notifications [miniorange-otp-verification]
Researcher
Affected Software
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas [salon-booking-system]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Taskbot [taskbot]
Researcher
Affected Software
Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform [ultimate-multisite]
Researcher
Affected Software
10Web Booster – Website speed optimization, Cache & Page Speed optimizer [tenweb-speed-optimizer]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Additional Order Filters for WooCommerce [additional-order-filters-for-woocommerce]
Researcher
Affected Software
Adwised Web Push Notification [adwised]
Affected Software
Researcher
Affected Software
ARforms [arforms]
Researcher
Affected Software
AWP Classifieds [another-wordpress-classifieds-plugin]
Researcher
Affected Software
Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale) [barcode-scanner-lite-pos-to-manage-products-inventory-and-orders]
Researcher
Affected Software
Before After Image Comparison – Visual Comparison for Two Images [before-after-image-compare]
Researcher
Blog, Posts and Category Filter for Elementor <= 2.1.0 – Unauthenticated Stored Cross-Site Scripting
7.2
Affected Software
Blog, Posts and Category Filter for Elementor [blog-posts-and-category-for-elementor]
Researcher
Affected Software
BuddyPress Instant Chat [bp-instant-chat]
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
click5 CRM add-on to Contact Form 7 [cf7-add-on-by-click5]
Researcher
Affected Software
click5 CRM add-on to Gravity Forms [gf-add-on-by-click5]
Researcher
Affected Software
click5 CRM add-on to Ninja Forms [click5-crm-add-on-to-ninja-forms]
Researcher
Affected Software
click5 CRM add-on to WPForms [wpf-add-on-by-click5]
Researcher
Affected Software
WP Coder – Insert & Manage Code Snippets [wp-coder]
Researcher
Affected Software
Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress [contact-form-to-db]
Researcher
Affected Software
Database for CF7 [database-for-cf7]
Researcher
Affected Software
Document Embedder – let visitors read files without downloading [document-emberdder]
Researcher
Affected Software
Document Gallery [document-gallery]
Researcher
Affected Software
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads]
Affected Software
Educavo – Education WordPress Theme [educavo]
Researcher
Affected Software
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More [envira-gallery-lite]
Researcher
Affected Software
Fastcache by Host.it [fastcache-by-host-it]
Researcher
Affected Software
Fluent Forms Pro Add On Pack [fluentformpro]
Researcher
Affected Software
Food Menu – Restaurant Menu & Online Ordering for WooCommerce [tlp-food-menu]
Researcher
Affected Software
Form Block [form-block]
Researcher
Affected Software
Researcher
Affected Software
FunnelKit – Funnel Builder Plugin for WooCommerce Checkout [funnel-builder]
Researcher
Affected Software
FV Player 8 [fv-player]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Affected Software
Hotel Booking [nd-booking]
Researcher
Affected Software
HTTP Requests Manager [http-requests-manager]
Researcher
Affected Software
Instapage Plugin [instapage]
Researcher
Affected Software
Researcher
Affected Software
Jotform – AI Chatbot [jotform-ai-chatbot]
Researcher
Affected Software
KeyWord Collector [keyword-collector]
Researcher
Affected Software
Researcher
Affected Software
LazyLoad Plugin – Lazy Load Images, Videos, and Iframes [rocket-lazy-load]
Researcher
Affected Software
Researcher
Affected Software
Researcher
LTL Freight Quotes – Old Dominion Edition <= 4.2.18 – Unauthenticated Stored Cross-Site Scripting
7.2
Affected Software
LTL Freight Quotes – ODFL Edition [ltl-freight-quotes-odfl-edition]
Researcher
Affected Software
Mapster WP Maps [mapster-wp-maps]
Researcher
Affected Software
Midtrans-WooCommerce [midtrans-woocommerce]
Researcher
Affected Software
Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress [molongui-authorship]
Researcher
Affected Software
Ocean eComm Treasure Box [ocean-ecommerce]
Ocean Pro Demos [ocean-pro-demos]
Researchers
Affected Software
OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. [host-webfonts-local]
Researcher
Affected Software
Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool]
Researcher
Affected Software
Photo Gallery by 10Web – Mobile-Friendly Image Gallery [photo-gallery]
Researcher
Affected Software
Photo Reviews for WooCommerce [woo-photo-reviews]
Researcher
Affected Software
Researcher
Affected Software
Piotnet Forms [piotnetforms]
Researcher
Affected Software
Podlove Podcast Publisher [podlove-podcasting-plugin-for-wordpress]
Researcher
Affected Software
Post Grid Gutenberg Blocks – PostX [ultimate-post]
Researcher
Affected Software
Researcher
Affected Software
Prenotazioni [prenotazioni]
Researchers
Affected Software
Presto Player [presto-player]
Researcher
Affected Software
Researcher
Affected Software
Qode Music [qode-music]
Researcher
Affected Software
Qode Real Estate [qode-real-estate]
Researcher
Affected Software
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker [quiz-master-next]
Researcher
Affected Software
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings [seo-by-rank-math]
Researcher
Real Estate Manager <= 7.3 – Unauthenticated Stored Cross-Site Scripting via ‘first_name’ Parameter
7.2
Affected Software
Real Estate Manager – Property Listing and Agent Management [real-estate-manager]
Researcher
Affected Software
Real3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder [real3d-flipbook-lite]
Researcher
Slider by 10Web – Responsive Image Slider <= 1.2.63 – Unauthenticated Stored Cross-Site Scripting
7.2
Affected Software
Slider by 10Web – Responsive Image Slider [slider-wd]
Researcher
Affected Software
SmugMug Embed [smugmug-embed]
Researcher
Affected Software
Social Rocket – Social Sharing Plugin [social-rocket]
Researcher
Social Share Icons & Social Share Buttons <= 3.7.5 – Unauthenticated Stored Cross-Site Scripting
7.2
Affected Software
Social Share Icons & Social Share Buttons [ultimate-social-media-plus]
Researcher
Affected Software
StoreGrowth – Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce [storegrowth-sales-booster]
Researcher
Affected Software
Researcher
Affected Software
Tabs Responsive – With WooCommerce Product Tabs Extension [tabs-responsive]
Researcher
Affected Software
Researcher
Affected Software
Topcontent [topcontent]
Researcher
Affected Software
Researcher
Affected Software
Video Background Block – Add Stunning Video Backgrounds to Any Section [video-background-block]
Researcher
Affected Software
VikBooking Hotel Booking Engine & PMS [vikbooking]
Researcher
Affected Software
VikRentCar Car Rental Management System [vikrentcar]
Researcher
Affected Software
Web Vitals Tracking [web-vitals-tracking]
Affected Software
WooCommerce Simple Auctions [woocommerce-simple-auctions]
Researcher
Patch Status
Patched
Patched
Published
Oct 6, 2026
Oct 6, 2026
Affected Software
WordPress [wordpress]
Researcher
Affected Software
WP Associate Post R2 [wp-associate-post-r2]
Researcher
Affected Software
WP File Download [wp-file-download]
Researcher
Affected Software
WP Mailster [wp-mailster]
Researcher
Affected Software
WP Meteor Website Speed Optimization Addon [wp-meteor]
Researcher
Affected Software
WP Photo Album Plus [wp-photo-album-plus]
Researcher
Affected Software
WPAdverts – Classifieds Plugin [wpadverts]
Researcher
WPAdverts <= 2.3.4 – Unauthenticated Stored Cross-Site Scripting via ‘adverts_location’ Parameter
7.2
Affected Software
WPAdverts – Classifieds Plugin [wpadverts]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool]
Researcher
Redux Framework <= 4.5.11 – Authenticated (Subscriber+) Privilege Escalation via Users Extension
6.8
Affected Software
Redux Framework [redux-framework]
Researcher
Product Configurator for WooCommerce <= 1.7.5 – Authenticated (Shop Manager+) PHP Object Injection
6.6
Affected Software
Product Configurator for WooCommerce [product-configurator-for-woocommerce]
Researcher
Affected Software
Super Video player – Fully Customizable Video Player with Playlist [super-video-player]
Researcher
Affected Software
WPML Multilingual & Multicurrency for WooCommerce [woocommerce-multilingual]
Researcher
Affected Software
YITH WooCommerce Affiliates [yith-woocommerce-affiliates]
Researcher
Affected Software
Researcher
Affected Software
Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale) [barcode-scanner-lite-pos-to-manage-products-inventory-and-orders]
Researcher
Affected Software
Boutique – Kute Fashion WooCommerce Theme ( RTL Supported ) [kute-boutique]
Researcher
Affected Software
BuddyBoss Platform [buddyboss-platform]
Researcher
Affected Software
ELEX WooCommerce Bulk Edit Products, Prices & Attributes (Basic) [elex-bulk-edit-products-prices-attributes-for-woocommerce-basic]
Researcher
Affected Software
Events Manager – Calendar, Bookings, Tickets, Appointments and more! [events-manager]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
ListingPro Plugin [listingpro-plugin]
Researcher
Affected Software
Name Directory [name-directory]
Researcher
Affected Software
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction [paid-member-subscriptions]
Researcher
Affected Software
paymendo – Bank Transfer (Lite) [paymendo-bank-transfer]
Researcher
Affected Software
Piotnet Addons For Elementor [piotnet-addons-for-elementor]
Researcher
Affected Software
Qode Tours [qode-tours]
Researcher
Affected Software
SiteOrigin Widgets Bundle [so-widgets-bundle]
Researcher
Affected Software
Slider by 10Web – Responsive Image Slider [slider-wd]
Researcher
Affected Software
Thanko Thank You Page Customizer for WooCommerce [woo-thank-you-page-customizer]
Researcher
Affected Software
uDesign | Multipurpose WordPress Theme [u-design-core]
Researcher
Vitepos – Point of Sale (POS) for WooCommerce <= 3.6.1 – Authenticated (Custom Role+) SQL Injection
6.5
Affected Software
Vitepos – Point of Sale (POS) for WooCommerce [vitepos-lite]
Researcher
Affected Software
W3 Total Cache [w3-total-cache]
Researcher
Affected Software
Woffice CRM [woffice]
Researcher
Affected Software
WP Booking System – Booking Calendar [wp-booking-system]
Researcher
Affected Software
WP Directory Kit [wpdirectorykit]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
WPBase Cache [wpbase-cache]
Researcher
Affected Software
Advanced Classifieds & Directory Pro [advanced-classifieds-and-directory-pro]
Researcher
Adwised Web Push Notification <= 2.5.7 – Authenticated (Subscriber+) Stored Cross-Site Scripting
6.4
Affected Software
Adwised Web Push Notification [adwised]
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Brizy – Page Builder [brizy]
Researcher
Affected Software
Church Admin [church-admin]
Researcher
Affected Software
Data Tables Generator by Supsystic [data-tables-generator-by-supsystic]
Researcher
Affected Software
Data Tables Generator by Supsystic [data-tables-generator-by-supsystic]
Researcher
Affected Software
Download Manager [download-manager]
Researcher
Affected Software
Download Manager [download-manager]
Researcher
Affected Software
eCommerce Product Catalog [ecommerce-product-catalog]
Researcher
Affected Software
Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons [bdthemes-element-pack-lite]
Researcher
Affected Software
Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons [bdthemes-element-pack-lite]
Researcher
Affected Software
Researcher
Affected Software
Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files [embed-any-document]
Researcher
Affected Software
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More [envira-gallery-lite]
Researcher
Affected Software
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More [envira-gallery-lite]
Researcher
Affected Software
Front End PM [front-end-pm]
Researcher
Affected Software
Frontend Admin by DynamiApps [acf-frontend-form-element]
Researcher
FV Flowplayer Video Player <= 7.5.54.7212 – Authenticated (Subscriber+) Stored Cross-Site Scripting
6.4
Affected Software
FV Flowplayer Video Player [fv-wordpress-flowplayer]
Researcher
Affected Software
FV Flowplayer Video Player [fv-wordpress-flowplayer]
Researcher
Affected Software
Gallery PhotoBlocks [photoblocks-grid-gallery]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Getwid <= 3.0.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘data-image-points’
6.4
Affected Software
Getwid – Gutenberg Blocks [getwid]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Graphene [graphene]
Researcher
Affected Software
HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates [happy-elementor-addons]
Researcher
Affected Software
Researcher
Affected Software
HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player [html5-audio-player]
Researcher
Affected Software
Image Photo Gallery Final Tiles Grid [final-tiles-grid-gallery-lite]
Researcher
Affected Software
Image Photo Gallery Final Tiles Grid [final-tiles-grid-gallery-lite]
Researcher
Affected Software
Image Slider [image-slider-widget]
Researcher
Affected Software
JetBlocks for Elementor [jet-blocks]
Researcher
Affected Software
JetElements [jet-elements]
Researcher
Affected Software
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks]
Researcher
Affected Software
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks]
Researcher
Affected Software
LazyLoad Plugin – Lazy Load Images, Videos, and Iframes [rocket-lazy-load]
Researcher
Affected Software
Researcher
Affected Software
Logo Showcase – Logo Slider, Carousel & Sponsors Gallery [logo-showcase]
Researcher
Affected Software
MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system]
Researcher
Affected Software
Media Library Assistant [media-library-assistant]
Researcher
Motors <= 1.4.123 – Authenticated (Subscriber+) Stored Cross-Site Scripting via ‘stm_f_s’ Parameter
6.4
Affected Software
Motors – Car Dealership & Classified Listings Plugin [motors-car-dealership-classified-listings]
Researcher
Affected Software
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar [mp3-music-player-by-sonaar]
Researcher
Affected Software
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar [mp3-music-player-by-sonaar]
Researcher
Affected Software
Name Directory [name-directory]
Researcher
Affected Software
PeproDev Ultimate Profile Solutions [peprodev-ups]
Researcher
Affected Software
Post Snippets – Custom WordPress Code Snippets Customizer [post-snippets]
Researcher
Affected Software
PowerPress Podcasting plugin by Blubrry [powerpress]
Researcher
Affected Software
Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates [premium-addons-for-elementor]
Researcher
Affected Software
Premium Packages – Sell Digital Products Securely [wpdm-premium-packages]
Researcher
Affected Software
Presto Player [presto-player]
Researcher
Affected Software
Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons [bdthemes-prime-slider-lite]
Researcher
Affected Software
QR Redirector [qr-redirector]
Researcher
Affected Software
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker [quiz-master-next]
Researcher
Affected Software
Robo Gallery – Photo & Image Slider [robo-gallery]
Researcher
Affected Software
Robo Gallery – Photo & Image Slider [robo-gallery]
Researcher
Affected Software
Robo Gallery – Photo & Image Slider [robo-gallery]
Researcher
Affected Software
Robo Gallery – Photo & Image Slider [robo-gallery]
Researcher
Affected Software
Robo Gallery – Photo & Image Slider [robo-gallery]
Researcher
Affected Software
Researcher
Affected Software
ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF [shortpixel-image-optimiser]
Researcher
Affected Software
Simple Membership [simple-membership]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Table Field Add-on for ACF and SCF [advanced-custom-fields-table-field]
Researcher
Affected Software
Table Field Add-on for ACF and SCF [advanced-custom-fields-table-field]
Researcher
Affected Software
Team – Team Members Showcase Plugin [tlp-team]
Researcher
Affected Software
Researcher
Affected Software
WC Fields Factory [wc-fields-factory]
Researcher
Patch Status
Patched
Patched
Published
Oct 7, 2026
Oct 7, 2026
Affected Software
WordPress [wordpress]
Researchers
Affected Software
WP Plugin Info Card [wp-plugin-info-card]
Researcher
Affected Software
WP Store Locator [wp-store-locator]
Researcher
Affected Software
Researcher
Affected Software
Zotpress [zotpress]
Researcher
Affected Software
AI Copilot – Content Generator [ai-copilot-content-generator]
Researcher
Affected Software
Researcher
Affected Software
JobZilla – Job Board WordPress Theme [jobzilla]
Researcher
Affected Software
Koinonia Link [koinonia-link]
Researcher
Affected Software
Mobile builder [mobile-builder]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
WP User Profiles [wp-user-profiles]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Aurora Heatmap [aurora-heatmap]
Researcher
Biolife – Organic Food WordPress Theme ( RTL Supported ) <= 3.2.3 – Reflected Cross-Site Scripting
6.1
Affected Software
Researcher
Affected Software
Download Manager [download-manager]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Favicon Rotator [favicon-rotator]
Researcher
Affected Software
Filter Everything — WordPress & WooCommerce Filters [filter-everything]
Researcher
Form Maker by 10Web <= 1.15.48 – Reflected Cross-Site Scripting via ‘inputs’ Parameter Array Key
6.1
Affected Software
Researcher
Affected Software
Gloria Admin Panel [gloria-admin-panel]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
kuteshop [kuteshop]
Researcher
Affected Software
Magee Shortcodes [magee-shortcodes]
Researchers
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Payment Plugins for Stripe WooCommerce [woo-stripe-payment]
Researcher
Affected Software
Researcher
Affected Software
Subscribe to Comments [subscribe-to-comments]
Researcher
Affected Software
Researcher
Affected Software
ThemeStek Extras for LabtechCO Theme [themestek-labtechco-extras]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Whistle – Sports Clothing & Fitness Equipment [whistle-sports-club]
Researcher
Affected Software
WPAdverts – Classifieds Plugin [wpadverts]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Spam Protection for Forms & Comments. Anti-Spam by CleanTalk [cleantalk-spam-protect]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Hello Plus [hello-plus]
Researcher
Affected Software
Researcher
Affected Software
Noptin – Newsletter, New Post Notifications & Email Automation [newsletter-optin-box]
Researcher
Affected Software
10WebSocial [wd-instagram-feed]
Researcher
Affected Software
Accept PayPal Payments using Contact Form 7 [contact-form-7-paypal-extension]
Researcher
Affected Software
Accept PayPal Payments using Contact Form 7 [contact-form-7-paypal-extension]
Researchers
Affected Software
Advanced Google reCAPTCHA [advanced-google-recaptcha]
Researcher
Affected Software
Advanced Posts Listing – Show Post List Easily [advanced-posts-listing]
Researcher
Affected Software
Airwallex Online Payments Gateway [airwallex-online-payments-gateway]
Researcher
Affected Software
Simply Schedule Appointments [simply-schedule-appointments]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Autoship Cloud for WooCommerce Subscription Products [autoship-cloud]
Researcher
Affected Software
BackWPup – WordPress Backup & Restore Plugin [backwpup]
Researcher
Affected Software
BackWPup – WordPress Backup & Restore Plugin [backwpup]
Researcher
Affected Software
Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale) [barcode-scanner-lite-pos-to-manage-products-inventory-and-orders]
Researcher
Affected Software
Bayarcash WooCommerce [bayarcash-wc]
Researcher
Affected Software
Booking Calendar [booking]
Researcher
Affected Software
Booking Calendar [booking]
Researcher
Affected Software
Booking Package [booking-package]
Researcher
Affected Software
Researcher
Affected Software
click5 CRM add-on to Contact Form 7 [cf7-add-on-by-click5]
Researcher
Affected Software
click5 CRM add-on to Gravity Forms [gf-add-on-by-click5]
Researcher
Affected Software
click5 CRM add-on to Ninja Forms [click5-crm-add-on-to-ninja-forms]
Researcher
Affected Software
click5 CRM add-on to WPForms [wpf-add-on-by-click5]
Researcher
Affected Software
Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe [contest-gallery]
Researcher
Affected Software
Researcher
Affected Software
CURCY – Multi Currency for WooCommerce [woo-multi-currency]
Researcher
Affected Software
WP CV Builder [cv-builder]
Researcher
Affected Software
DK [dk]
Researcher
Affected Software
DTX – Dynamic Text Extension for Contact Form 7 [contact-form-7-dynamic-text-extension]
Researcher
Affected Software
E-cab Taxi Booking Manager for Woocommerce [ecab-taxi-booking-manager]
Researcher
Affected Software
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads]
Researcher
Affected Software
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads]
Researcher
Affected Software
Edwiser Bridge – WordPress Moodle Integration [edwiser-bridge]
Researcher
Affected Software
eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams [eroom-zoom-meetings-webinar]
Researcher
Affected Software
Event Tickets and Registration [event-tickets]
Researcher
Affected Software
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution]
Researcher
Affected Software
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution]
Researcher
Affected Software
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution]
Researcher
Affected Software
Events Manager – Calendar, Bookings, Tickets, Appointments and more! [events-manager]
Researcher
Affected Software
Researcher
Affected Software
Fluent Affiliate Pro [fluent-affiliate-pro]
Researcher
Affected Software
Fluent Booking Pro [fluent-booking-pro]
Researcher
Affected Software
Fluent Forms Pro Add On Pack [fluentformpro]
Researcher
Affected Software
Researcher
Affected Software
Geliver Akıllı Kargo Pazaryeri [geliver-akilli-kargo-pazaryeri]
Researcher
Affected Software
GIFT4U – Gift Cards All in One for Woo [gift4u-gift-cards-all-in-one-for-woo]
Researcher
Affected Software
Researcher
Affected Software
grandnews [grandnews]
Researcher
Affected Software
Graphina – Charts and Graphs For Elementor [graphina-elementor-charts-and-graphs]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Insurify – Order & Shipping Protection [insurify]
Researcher
Affected Software
Insurify – Order & Shipping Protection [insurify]
Researcher
Affected Software
Integration for Epos Now and WooCommerce [woo-epos-now-integration]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Kit (formerly ConvertKit) for WooCommerce [convertkit-for-woocommerce]
Researcher
Affected Software
Livees Checkout [livees-checkout]
Researcher
Affected Software
Login Lockdown & Protection [login-lockdown]
Researcher
Affected Software
Magee Shortcodes [magee-shortcodes]
Researcher
Affected Software
Mailjet Email Marketing [mailjet-for-wordpress]
Researcher
Modula Image Gallery – Photo Grid & Video Gallery <= 3.0.11 – Unauthenticated Information Exposure
5.3
Affected Software
Modula Image Gallery – Photo Grid & Video Gallery [modula-best-grid-gallery]
Researcher
Affected Software
Morning for WooCommerce [wc-gateway-greeninvoice]
Researcher
Affected Software
Researcher
Affected Software
Motors – Car Dealership & Classified Listings Plugin [motors-car-dealership-classified-listings]
Researcher
Affected Software
Museder RestoreOne [museder-restoreone]
Researcher
Affected Software
Nexi XPay Build [nexi-xpay-build]
Researcher
Affected Software
Nexi XPay Build [nexi-xpay-build]
Affected Software
Norvis Backup [norvis-backup]
Researcher
Affected Software
Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool]
Researcher
Affected Software
Order Export & Order Import for WooCommerce [order-import-export-for-woocommerce]
Researcher
Affected Software
Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway [cryptocurrency-payments-using-metamask-for-woocommerce]
Researcher
Affected Software
PayPlug for WooCommerce (Official) [payplug]
Researcher
Affected Software
PayPlug for WooCommerce (Official) [payplug]
Researcher
Affected Software
Researcher
Affected Software
WP Posts Password Batch Manager [wp-posts-password-batch-manager]
Researcher
Affected Software
PowerPress Podcasting plugin by Blubrry [powerpress]
Researcher
Affected Software
PowerPress Podcasting plugin by Blubrry [powerpress]
Researcher
Affected Software
Quick quotes – WPSHARE247 [quick-quotes-wpshare247]
Researcher
Restrict User Access – Ultimate Membership & Content Protection <= 2.8.1 – Missing Authorization
5.3
Affected Software
Restrict User Access – Ultimate Membership & Content Protection [restrict-user-access]
Researcher
Affected Software
Researcher
Affected Software
Scripts n Styles [scripts-n-styles]
Researcher
Affected Software
Sell Downloads [sell-downloads]
Researcher
Affected Software
SendPress Newsletters [sendpress]
Researcher
Affected Software
Shipping for Nova Poshta [nova-poshta-ttn]
Researcher
Affected Software
Sitemovr [sitemovr]
Researcher
SiteVault – Backup, Restore, Migration & Cloning <= 1.5.17 – Unauthenticated Information Exposure
5.3
Affected Software
SiteVault – Backup, Restore, Migration & Cloning [sitevault-backup-restore-migration]
Researcher
Affected Software
SKU Error Fixer for WooCommerce [sku-error-fixer-for-woocommerce]
Researcher
Snapshotify – All-in-One Backup & Restore & Migrate <= 1.3.2 – Unauthenticated Information Exposure
5.3
Affected Software
Snapshotify – All-in-One Backup & Restore & Migrate [snapshotify]
Researcher
Affected Software
Social Web Suite – Social Media Auto Post, Social Media Auto Publish [social-web-suite]
Researcher
Affected Software
Super Payments – WooCommerce Payment Gateway [super-payments]
Researcher
Affected Software
Swish Migrate and Backup [swish-migrate-and-backup]
Researcher
Affected Software
Researcher
Affected Software
Track Orders for WooCommerce – Multi Carrier WooCommerce Shipping [track-orders-for-woocommerce]
Researcher
Affected Software
TrueBooker – Appointment Booking and Scheduler System [truebooker-appointment-booking]
Researcher
Affected Software
TutorStarter [tutorstarter]
Researcher
Affected Software
UnitechPay – Wave & Orange Money Payments [unitechpay-paiements-mobile-money]
Researcher
Affected Software
WCFM – Multivendor Marketplace REST API for WooCommerce [wcfm-marketplace-rest-api]
Researcher
Affected Software
Web Plura Backup & Restore – Local Backups, Restore & Recovery [web-plura-backup-restore-manager]
Researcher
Affected Software
WeddingCity Lite – Wedding Directory and Listing [weddingcity-lite]
Researcher
Affected Software
WooCommerce Bookings [woocommerce-bookings]
Researcher
Affected Software
WordPress [wordpress]
Researcher
Affected Software
Researcher
Affected Software
WP Rocket [wp-rocket]
Researcher
Affected Software
WP Rollback – Rollback Plugins and Themes [wp-rollback]
Researcher
Affected Software
Researcher
Affected Software
WXD Backup Lite [wxd-backup-lite]
Researcher
Affected Software
XServer Migrator [xserver-migrator]
Researcher
Affected Software
YITH WooCommerce Product Add-Ons [yith-woocommerce-product-add-ons]
Researcher
Affected Software
YITH WooCommerce Product Bundles [yith-woocommerce-product-bundles]
Researcher
Affected Software
Zero Spam for WordPress [zero-spam]
Researcher
Affected Software
affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display [affiliate-toolkit-starter]
Researcher
Affected Software
Animated Number Counters [animated-number-counters]
Researcher
BackWPup – WordPress Backup & Restore Plugin < 5.7.7 – Authenticated (Administrator+) Path Traversal
4.9
Affected Software
BackWPup – WordPress Backup & Restore Plugin [backwpup]
Researcher
Affected Software
Code Snippets [code-snippets]
Researcher
Affected Software
Dynamic User Directory [dynamic-user-directory]
Researcher
Affected Software
Frontend Admin by DynamiApps [acf-frontend-form-element]
Researcher
Affected Software
Leyka [leyka]
Researcher
Affected Software
Researcher
Affected Software
MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO [multiple-pages-generator-by-porthas]
Researcher
Affected Software
Pix por Piggly (para Woocommerce) [pix-por-piggly]
Researcher
Affected Software
Post Export Import with Media [post-export-import-with-media]
Researcher
Affected Software
Post title marquee scroll [post-title-marquee-scroll]
Researcher
Affected Software
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings [seo-by-rank-math]
Researcher
Affected Software
Smart Popup by Supsystic [popup-by-supsystic]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export [wp-ultimate-csv-importer]
Researcher
Fluent Forms <= 6.2.14 – Reflected Cross-Site Scripting via ‘{get.*}’ Editor SmartCode Parameter
4.7
Affected Software
Researcher
Affected Software
Import and export users and customers [import-users-from-csv-with-meta]
Researcher
Affected Software
JetFormBuilder — Dynamic Blocks Form Builder [jetformbuilder]
Researcher
Affected Software
PDF Invoices & Packing Slips for WooCommerce – Challan [webappick-pdf-invoice-for-woocommerce]
Researcher
Affected Software
WooCommerce [woocommerce]
Researcher
Affected Software
Researcher
Affected Software
HireZoot – Job Listings, Career Page & Recruitment Tool [wp-job-openings]
Researcher
Affected Software
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings [seo-by-rank-math]
Researcher
Affected Software
Responsive Lightbox & Gallery [responsive-lightbox]
Researcher
Affected Software
Researcher
Affected Software
Researcher
ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce <= 2.2.4 – Missing Authorization
4.3
Affected Software
ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce [woo-alidropship]
Researcher
Affected Software
All Bootstrap Blocks [all-bootstrap-blocks]
Researcher
Affected Software
App for Cloudflare® [app-for-cf]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Asgaros Forum [asgaros-forum]
Researcher
Affected Software
Researcher
Affected Software
AutoPoly – AI Translation For Polylang [automatic-translations-for-polylang]
Researcher
Before After Image Comparison – Visual Comparison for Two Images <= 1.1.21 – Missing Authorization
4.3
Affected Software
Before After Image Comparison – Visual Comparison for Two Images [before-after-image-compare]
Researcher
Booktics – Appointment Booking Calendar for Service Businesses <= 1.0.27 – Missing Authorization
4.3
Affected Software
Researcher
Affected Software
WP Comment Cleaner – Delete All Comments, Disable Comments, Bulk Delete & Remove Comments [delete-all-comments-of-website]
Researcher
Affected Software
CP Media Player – Audio Player and Video Player [audio-and-video-player]
Researcher
Affected Software
Dashboard Notes [dashboard-notes]
Researcher
Affected Software
Database Addon For WPForms ( wpforms entries ) – WPFormsDB [database-for-wpforms]
Researcher
Directory Listings WordPress plugin – uListing <= 2.2.0 – Missing Authorization to Settings Update
4.3
Affected Software
Researcher
Affected Software
Disable Users [disable-users]
Researcher
Affected Software
Researcher
Affected Software
Download Manager [download-manager]
Researcher
Affected Software
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads]
Researcher
Affected Software
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More [envira-gallery-lite]
Researcher
Affected Software
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More [envira-gallery-lite]
Researcher
Affected Software
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More [envira-gallery-lite]
Researcher
Affected Software
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More [envira-gallery-lite]
Researcher
Affected Software
Event Tickets and Registration [event-tickets]
Researcher
Affected Software
Event Tickets and Registration [event-tickets]
Researcher
Affected Software
Event Tickets and Registration [event-tickets]
Researcher
Affected Software
Researcher
Affected Software
Frontend Dashboard [frontend-dashboard]
Researcher
Affected Software
GDPR Data Request Form [gdpr-data-request-form]
Researcher
Affected Software
Grocery Shopping Store [grocery-shopping-store]
Researcher
Affected Software
Hotel Booking [nd-booking]
Researcher
Affected Software
Hotel Booking [nd-booking]
Researcher
Affected Software
Hustle – Email Marketing, Lead Generation, Optins, Popups [wordpress-popup]
Researcher
Affected Software
Image Photo Gallery Final Tiles Grid [final-tiles-grid-gallery-lite]
Researcher
Affected Software
Jetpack VideoPress [jetpack-videopress]
Researcher
Affected Software
JS Help Desk – AI-Powered Support & Ticketing System [js-support-ticket]
Researcher
Affected Software
JS Help Desk – AI-Powered Support & Ticketing System [js-support-ticket]
Researcher
Affected Software
Memberful – Membership Plugin [memberful-wp]
Researcher
Affected Software
Researcher
Affected Software
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions [dc-woocommerce-multi-vendor]
Researcher
Affected Software
Researcher
Affected Software
Polylang [polylang]
Researcher
Affected Software
Portfolio Filter Gallery – Photo Gallery [portfolio-filter-gallery]
Researcher
Affected Software
Portfolio Filter Gallery – Photo Gallery [portfolio-filter-gallery]
Researcher
Affected Software
PowerPress Podcasting plugin by Blubrry [powerpress]
Researcher
Affected Software
Pubjet | پابجت [pubjet]
Researcher
Affected Software
QA Assistants – Driven by data [qa-heatmap-analytics]
Researcher
Affected Software
SendPress Newsletters [sendpress]
Researcher
Affected Software
Simple JWT Login – Allows you to use JWT on REST endpoints. [simple-jwt-login]
Researcher
Affected Software
MemberHero – Simple User Registration & Login [wp-registration]
Researcher
Affected Software
Squadeno – Club Sports Manager [squadeno-club-sports-manager]
Researcher
Affected Software
Researcher
Affected Software
Th Shop Mania [th-shop-mania]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Unlimited Elements for Elementor [unlimited-elements-for-elementor]
Researcher
Affected Software
Upcasted S3 Offload – AWS S3, DigitalOcean Spaces, Backblaze, MinIO Storage Integration [upcasted-s3-offload]
Researcher
Affected Software
User Private Files – Secure File Sharing and Client Portal Plugin [user-private-files]
Researcher
Affected Software
Video Conferencing with Zoom [video-conferencing-with-zoom-api]
Researcher
Affected Software
VillaTheme Core [villatheme-core]
Researcher
Affected Software
Visual Composer Website Builder [visualcomposer]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Wordable – Export Google Docs to WordPress [wordable]
Researcher
Affected Software
Researcher
Affected Software
WP Admin Audit [wp-admin-audit]
Researcher
Affected Software
WP Comment Cleaner – Delete All Comments, Disable Comments, Bulk Delete & Remove Comments [delete-all-comments-of-website]
Researcher
Affected Software
WP Dummy Content Generator [wp-dummy-content-generator]
Researcher
Affected Software
Researcher
Affected Software
WP Mailster [wp-mailster]
Researcher
Affected Software
Researcher
Affected Software
WP-Invoice – Web Invoice and Billing [wp-invoice]
Researcher
Affected Software
Researcher
Affected Software
WPComplete [wpcomplete]
Researcher
WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 44.1 – Missing Authorization
4.3
Affected Software
Researcher
Affected Software
wpsection [wpsection]
Researcher
WPVR – 360 Panorama viewer and Virtual Tour Builder for WordPress <= 9.1.3 – Missing Authorization
4.3
Affected Software
Researcher
Affected Software
Yaad Sarig Payment Gateway For WC [yaad-sarig-payment-gateway-for-wc]
Researcher
Affected Software
SpeedyCache – Cache, Optimization, Performance [speedycache]
Researcher
Patch Status
Patched
Patched
Published
Oct 7, 2026
Oct 7, 2026
Affected Software
WordPress [wordpress]
Researcher
Affected Software
AI Puffer – MCP, AI Chatbot & Content Automation [gpt3-ai-content-generator]
Researcher
Affected Software
AI Puffer – MCP, AI Chatbot & Content Automation [gpt3-ai-content-generator]
Researcher
Affected Software
Simple Membership [simple-membership]
Researcher
Affected Software
Booking Calendar [booking]
Researcher
Affected Software
Code Snippets [code-snippets]
Researcher
Affected Software
Researcher
As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.
This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
The post Wordfence Intelligence Weekly WordPress Vulnerability Report (October 5, 2026 to October 11, 2026) appeared first on Wordfence.