WordPress plugin vulnerabilities: week 13, 2025
128 vulnerabilities published Mar 24 – Mar 30, 2025 in 112 plugins we track, by day.
5 critical 33 high 82 medium 8 low
Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.
“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.
Saturday, March 29, 2025 · 1
Friday, March 28, 2025 · 16
-
medium 4.3 SimplyRETS Real Estate IDX
-
medium 6.5 FormLift for Keap (Legacy) Web Forms
-
high 7.1 Hostel
-
medium 6.5 Leaky Paywall
-
medium 6.5 Paid Membership Subscriptions
-
medium 6.5 RPS Include Content
-
medium 6.5 MicroPayments
-
medium 4.9 WP Compress for MainWP
-
medium 5.3 Advanced Google reCAPTCHA
-
medium 5.3 Booking for Appointments and Events Calendar
-
medium 4.3 Event Tickets with Ticket Scanner
-
critical 9.8 Kubio AI Page Builder
Thursday, March 27, 2025 · 69
-
high 7.5 HUSKY
-
medium 5.3 LearnPress
-
critical 9.8 Hide My WP Ghost
-
medium 5.9 WooCommerce
-
high 8.8 GEO Plugin by Squirrly SEO
-
medium 5.3 iNET Webkit
-
medium 6.5 VikBooking Hotel Booking Engine & PMS
-
medium 5.4 Orbit Fox
-
medium 5.4 aThemes Addons for Elementor
-
high 7.6 Payment Forms for Paystack
-
medium 4.8 Project Manager
-
medium 6.5 Quick Interest Slider
-
medium 4.4 MetForm
-
high 7.6 Newsletters
-
medium 6.5 Structured Content (JSON-LD) #wpsc
-
medium 5.9 Chartify
-
medium 5.4 SecuPress with Simple SSL
-
medium 4.8 User Registration & Membership
-
medium 5.4 ERP
-
medium 4.3 WP Fast Total Search
-
medium 6.5 LeadConnector
-
medium 6.5 افزونه حمل و نقل ووکامرس
-
high 8.8 Travelly
-
medium 4.7 Bit Form
-
medium 4.7 Bit integrations
-
medium 5.3 Event Booking Manager for WooCommerce
-
medium 5.4 Greenshift
-
low 2.7 Quiz Cat
-
high 7.6 MoreConvert Wishlist for WooCommerce
-
medium 4.3 Specific Content For Mobile
-
high 7.5 WP Travel Engine
-
medium 4.9 Five Star Restaurant Reservations
-
medium 4.7 AliNext
-
medium 6.5 Off-Canvas Sidebars & Menus (Slidebars)
-
medium 4.3 Tickera
-
medium 6.5 Cozy Blocks
-
medium 5.3 E-cab Taxi Booking Manager for Woocommerce
-
high 8.8 Restaurant Menu and Food Ordering
-
medium 6.5 Appointment Booking Plugin
-
medium 6.5 Themify Event Post
-
high 7.5 Themify Event Post
-
medium 5.3 Timetics
-
high 7.5 WPCafe
-
medium 5.3 SNORDIAN's H5PxAPIkatchu
-
medium 5.4 Textmetrics
-
high 7.5 WishSuite
-
medium 6.5 SKT Addons for Elementor
-
high 7.5 The Post Grid
-
high 8.5 Vimeotheque
-
medium 6.5 Gum Addon for Elementor
-
medium 4.7 FunnelKit Automations
-
medium 6.5 Quotes llama
-
high 8.2 WP Google Review Slider
-
medium 6.5 Charitable
-
medium 4.3 Support Genix
-
high 7.2 TranslatePress
-
high 8.5 One to one user Chat by WPGuppy
-
medium 4.3 Football Pool
-
medium 6.5 HappyAddons for Elementor
-
high 7.6 FlexStock
-
medium 5.4 TablePress
-
critical 9.8 Export All Posts, Products, Orders & Users
Wednesday, March 26, 2025 · 23
-
high 7.1 Blue Captcha
-
critical 9.3 Church Admin
-
medium 6.5 Event Post
-
high 7.1 MicroPayments
-
high 7.1 Picture Gallery
-
high 7.1 Video Share VOD
-
medium 5.7 Responsive Addons for Elementor
-
medium 6.5 Product Import Export for WooCommerce
-
medium 4.9 Product Import Export for WooCommerce
-
high 8.8 WP Compress
-
high 7.2 WordPress Importer
-
medium 5.3 Advanced iFrame
Security issue
-
medium 5.4 Advanced iFrame
-
medium 5.4 Advanced iFrame
-
medium 6.5 Job Postings
-
high 7.2 Total Upkeep
-
medium 5.4 Event Post
-
high 7.2 Newsletters
-
high 7.3 Active Woot Products Tables for WooCommerce. 1…
Security issue
-
medium 6.4 Spectra Legacy
-
medium 4.3 Ultimate Dashboard
Tuesday, March 25, 2025 · 14
-
critical 9.3 Web Directory plugin Free
-
medium 5.8 WP Compress
-
medium 5.3 Easy Digital Downloads
-
medium 4.3 teachPress
-
medium 5.3 Directorist
-
low 3.5 Favorites
-
low 3.5 Social Slider Feed
-
medium 6.1 Quiz and Survey Master (QSM)
-
medium 6.1 Registrations for the Events Calendar
-
medium 6.1 Slider by 10Web
-
medium 6.1 Slider by 10Web
-
low 3.5 Form Maker by 10Web
-
medium 5.9 Stylish Price List
-
medium 5.9 Job Postings
Monday, March 24, 2025 · 5
-
medium 5.3 APPExperts
-
low 3.5 Form Maker by 10Web
-
low 3.5 Photo Gallery by 10Web
Ran a vulnerable version? Check your site for signs of a hack
The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.
Browse vulnerabilities
Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution
Where this data comes from
- Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Plugin versions, update dates and install counts: the wordpress.org Plugins API.
- These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.