WordPress plugin vulnerabilities: week 11, 2025
47 vulnerabilities published Mar 10 – Mar 16, 2025 in 32 plugins we track, by day.
1 critical 17 high 25 medium 4 low
Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.
“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.
Sunday, March 16, 2025 · 7
-
low 3.5 GDPR Cookie Compliance
-
low 3.5 GDPR Cookie Compliance
-
low 3.5 GDPR Cookie Compliance
-
medium 4.8 GDPR Cookie Compliance
-
medium 4.8 GDPR Cookie Compliance
-
medium 4.8 GDPR Cookie Compliance
-
medium 4.6 Download Manager
Security issue
Saturday, March 15, 2025 · 14
-
high 8.5 Private Content
-
high 7.1 Private Content
-
high 8.3 Private Content
-
high 8.8 Booking and Rental Manager for Bike
-
high 7.5 GiveWP
-
medium 6.1 WP Test Email
-
medium 4.9 Responsive Thumbnail Slider
-
medium 6.5 School Management System
-
medium 6.5 School Management System
-
medium 5.4 School Management System
-
medium 4.3 School Management System
-
high 8.8 affects latest 2.2.0 Directory Listings WordPress plugin
-
high 8.8 affects latest 2.2.0 Directory Listings WordPress plugin
Friday, March 14, 2025 · 5
-
medium 5.3 ShareThis Dashboard for Google Analytics
-
medium 6.5 Omnipress
-
high 7.5 WPCOM Member
-
high 8.8 InstaWP Connect
-
high 7.5 Hide My WP Ghost
Thursday, March 13, 2025 · 6
-
high 7.5 All-in-One WP Migration and Backup
-
high 8.1 Download Manager
-
high 7.3 Simply Schedule Appointments
-
medium 4.3 Page Builder
-
medium 6.4 WP Recipe Maker
-
medium 5.3 Business Directory Plugin
Wednesday, March 12, 2025 · 7
-
medium 5.4 ShopLentor
-
medium 4.3 Page Builder
-
low 3.8 Uncanny Automator
-
medium 5.4 Finale Lite
-
medium 5.3 NEX-Forms
-
medium 4.8 GDPR Cookie Compliance
-
medium 5.3 WP Crowdfunding
Tuesday, March 11, 2025 · 6
-
high 8.8 SchemaEngine AI
-
medium 4.3 REST API TO MiniProgram
-
medium 6.5 Qubely
-
high 7.1 Countdown Timer
-
high 7.3 WPCS
-
critical 9.8 HUSKY
Monday, March 10, 2025 · 2
-
medium 6.1 WPBookit
-
medium 4.3 Page Builder
Ran a vulnerable version? Check your site for signs of a hack
The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.
Browse vulnerabilities
Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution
Where this data comes from
- Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Plugin versions, update dates and install counts: the wordpress.org Plugins API.
- These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.