WordPress plugin vulnerabilities: week 2, 2025
103 vulnerabilities published Jan 6 – Jan 12, 2025 in 93 plugins we track, by day.
11 critical 22 high 69 medium 1 low
Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.
“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.
Saturday, January 11, 2025 · 5
-
critical 9.8 GiveWP
-
medium 6.1 Booking and Rental Manager for Bike
-
medium 6.1 Push Notification for Post and BuddyPress
-
medium 5.4 Kadence Blocks
-
medium 4.3 Post Duplicator
Friday, January 10, 2025 · 2
Thursday, January 9, 2025 · 11
-
critical 9.8 WPBookit
-
medium 5.4 Button Block
-
medium 6.5 WPBot
-
medium 6.5 Author Avatars List/Block
-
high 7.1 Product Table for WooCommerce
-
medium 5.4 Greenshift
-
high 8.8 SKT Page Builder
-
medium 6.4 SimplyRETS Real Estate IDX
-
high 7.5 WP Database Backup
-
medium 6.5 WP Travel
-
medium 5.4 Unlimited Elements for Elementor
Wednesday, January 8, 2025 · 20
-
medium 6.4 DearFlip
-
high 7.5 Ultimate Gift Cards for WooCommerce
-
high 8.8 Garden Gnome Package
-
high 8.8 Modula Image Gallery
-
medium 5.3 WP EasyCart
-
high 7.5 Iptanus File Upload
-
medium 4.8 Gutenberg Essential Blocks
-
critical 9.8 Iptanus File Upload
-
medium 5.4 Element Pack Addons for Elementor
-
medium 5.4 HappyAddons for Elementor
-
critical 9.8 Iptanus File Upload
-
medium 6.5 Xpro Addons
-
medium 6.1 Property Hive
-
medium 5.3 InfiniteWP Client
-
medium 5.4 Themesflat Addons For Elementor
-
medium 6.5 MDTF
-
medium 6.4 Easy Form Builder by WhiteStudio
-
medium 5.3 SureForms
-
medium 5.4 WP Extended
-
high 8.8 WP Extended
Tuesday, January 7, 2025 · 63
-
medium 6.5 Hash Elements
-
medium 5.3 Link Whisper Free
-
medium 4.3 Hide Category by User Role for WooCommerce
-
medium 5.4 WP Delete Post Copies
-
medium 6.1 User Profile Builder
-
medium 4.3 WP Job Portal
-
medium 5.3 Jupiter X Core
-
medium 5.3 RSVP and Event Management
-
medium 4.3 Jupiter X Core
-
medium 6.4 Quill Forms
-
medium 6.5 Piotnet Addons For Elementor
-
medium 6.5 Smart Custom Fields
-
medium 6.5 SpeakOut! Email Petitions
-
medium 6.5 Thim Kit for Elementor
-
medium 5.4 WPBITS Addons For Elementor Page Builder
-
medium 5.3 WP Wand
-
medium 5.4 MyBookTable Bookstore by Stormhill Media
-
medium 5.4 PixelYourSite
-
high 7.5 WP Mailster
-
medium 4.3 WP Visitor Statistics (Real Time Traffic)
-
medium 4.3 SOOZ
-
medium 6.5 Gutentor
-
medium 6.5 WP FullCalendar
-
medium 5.9 Advanced Form Integration
-
high 7.1 Mang Board
-
high 7.1 Notify Odoo
-
medium 6.4 Nexter Blocks
-
high 7.1 Groundhogg
-
medium 4.8 WP Docs
-
high 8.1 Locatoraid Store Locator
-
high 7.5 워드프레스 결제 심플페이
-
critical 9.3 SSL Wireless SMS Notification
-
medium 5.4 WPBITS Addons For Elementor Page Builder
-
critical 9.1 Export All Posts, Products, Orders & Users
-
high 8.8 WPForms
-
high 8.8 One to one user Chat by WPGuppy
-
medium 5.4 Astra Widgets
-
critical 9.8 WPvivid
-
critical 9.8 Build App Online
-
medium 4.3 Bus Ticket Booking with Seat Reservation
-
medium 6.1 DirectoryPress
-
critical 9.8 One to one user Chat by WPGuppy
-
critical 10.0 JobBoard Job listing plugin
-
medium 4.3 Iptanus File Upload
-
medium 6.1 Booking calendar, Appointment Booking System
-
medium 5.3 Export Import Menus
-
medium 5.4 Master Addons for Elementor
-
medium 5.4 Sina Extension for Elementor
-
high 8.8 SMS Alert
-
high 7.5 Passster
-
medium 5.4 Social Rocket
-
medium 5.3 Social Rocket
-
high 7.1 JoomSport
-
low 2.7 Form Maker by 10Web
-
medium 6.5 School Management System
-
medium 6.1 Infility Global
-
critical 9.8 PayU India
-
medium 5.3 WordLift
-
medium 6.5 Infility Global
-
medium 6.5 WOW Styler for CF7
Monday, January 6, 2025 · 2
-
medium 6.1 Icegram Engage
-
medium 6.1 Pods
Ran a vulnerable version? Check your site for signs of a hack
The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.
Browse vulnerabilities
Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution
Where this data comes from
- Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Plugin versions, update dates and install counts: the wordpress.org Plugins API.
- These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.