WordPress plugin vulnerabilities: week 14, 2025
168 vulnerabilities published Mar 31 – Apr 6, 2025 in 147 plugins we track, by day.
14 critical 54 high 100 medium
Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.
“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.
Sunday, April 6, 2025 · 1
-
medium 6.5 Broken Link Checker by AIOSEO
Saturday, April 5, 2025 · 3
-
medium 6.5 MultiVendorX
-
high 7.5 Read More & Accordion
-
medium 6.4 Link Library
Friday, April 4, 2025 · 65
-
medium 4.3 RepairBuddy
-
high 8.8 Project Manager
-
medium 4.3 Broadstreet
-
medium 4.3 WP w3all phpBB
-
medium 4.3 JobWP
-
medium 4.3 Sequential Order Numbers for WooCommerce
-
medium 5.3 affects latest 3.2.7 StaffList
-
medium 5.3 SurveyJS
-
medium 5.3 Course Booking System
-
medium 5.4 DirectoryPress
-
medium 5.3 WPBookit
-
medium 4.3 MasterStudy LMS WordPress Plugin
-
medium 4.3 Social Share Buttons & Analytics Plugin
-
medium 4.3 MP3 Audio Player
-
medium 4.3 Revive.so
-
medium 4.3 affects latest 3.2.7 StaffList
-
medium 5.4 TableOn
-
high 8.8 Salon Booking System
-
medium 5.3 WP Event Manager
-
medium 5.4 Ai Image Alt Text Generator for WP
-
medium 6.5 Ecwid by Lightspeed Ecommerce Shopping Cart
-
medium 6.5 LA-Studio Element Kit for Elementor
-
medium 6.5 affects latest 1.0.9 News Element Elementor Blog Magazine
-
medium 6.5 News Kit Addons For Elementor
-
medium 6.5 Piotnet Addons For Elementor
-
medium 6.5 Ultra Addons Lite for Elementor
-
medium 6.5 Advanced Woo Labels
-
medium 5.4 Colibri Page Builder
-
medium 5.4 6Storage Rentals
-
medium 6.5 Ultimate Store Kit
-
medium 6.5 bBlocks
-
medium 6.5 SimpLy Gallery
-
medium 6.5 Tableberg
-
medium 6.5 YaMaps for WordPress Plugin
-
medium 6.5 Gutenify
-
medium 6.5 Motors
-
medium 6.5 SurveyJS
-
medium 6.5 Chamber Dashboard Business Directory
-
high 7.5 Radius Blocks
-
medium 6.5 Xpro Addons
-
high 8.8 BuddyForms
-
high 7.5 Real Estate Manager
-
high 7.5 Slider a SlidersPack
-
high 8.8 teachPress
-
medium 6.6 Easy Google Maps by Supsystic
Security issue
-
high 8.8 MasterStudy LMS WordPress Plugin
-
high 8.8 Motors
-
medium 4.9 s2Member
-
medium 5.9 URL Shortify
-
high 7.6 affects latest 1.0.4 Pay with Contact Form 7
-
high 7.6 Behance Portfolio Manager
-
critical 9.1 CMP
-
high 7.1 Sidebar Manager Light
-
high 7.6 affects latest 2.2.0 Directory Listings WordPress plugin
-
high 7.6 wpForo Forum
-
medium 6.4 RegistrationMagic
-
high 7.2 Booster for WooCommerce
-
high 8.8 Uncanny Automator
-
critical 9.8 Booster for WooCommerce
Thursday, April 3, 2025 · 8
-
medium 4.9 Category Icon
-
medium 6.3 FPW Category Thumbnails
-
high 7.1 Contact Form vCard Generator
-
high 8.8 Testimonial
-
high 7.1 Web Directory plugin Free
-
medium 5.4 Modula Image Gallery
-
medium 4.4 User Submitted Posts
-
medium 5.4 Unlimited Elements for Elementor
Wednesday, April 2, 2025 · 1
Tuesday, April 1, 2025 · 67
-
medium 6.5 Nova Blocks by Pixelgrade
-
high 8.5 Actionwear products sync
-
high 7.1 Fonts Manager
-
high 7.2 Salon Booking System
-
critical 9.3 Advanced Reporting and Statistics for WooComme…
-
high 8.1 Material Dashboard
-
high 8.5 Order Splitter for WooCommerce
-
high 7.1 Enable Media Replace
-
high 7.1 HTML Forms
-
medium 5.4 ShortPixel Adaptive Images
-
high 8.8 Travelly
-
medium 6.1 Watu Quiz
-
critical 9.3 Next-Cart Store to WooCommerce Migration
-
high 7.1 VPSUForm
-
medium 6.5 WP Crowdfunding
-
medium 4.3 RestroPress
-
medium 4.3 Theater for WordPress
-
medium 4.3 Group Chat & Video Chat by AtomChat
-
medium 5.3 affects latest 1.2.8 JobBoard Job listing plugin
-
medium 4.9 affects latest 1.2.8 JobBoard Job listing plugin
-
medium 6.5 WP Plugin Info Card
-
medium 5.3 WP Simple HTML Sitemap
-
medium 4.3 Automatic Featured Images from Videos
-
medium 4.3 OwnerRez
-
medium 6.5 affects latest 3.1 Planyo online reservation system
-
medium 5.3 PickPlugins Question Answer
-
medium 6.5 MX Time Zone Clocks
-
medium 5.9 Webling
-
medium 6.5 Sprout Clients
-
medium 5.4 Query Wrangler
-
medium 5.3 Astra Security Suite
-
medium 6.5 Breaking News WP
-
medium 5.9 Breaking News WP
-
medium 4.3 Zoho Flow
-
critical 9.8 SMS Alert
-
high 8.8 Welcart e-Commerce
-
medium 5.5 Groundhogg
-
medium 6.4 PowerPack Addons for Elementor
-
medium 6.1 Booster for WooCommerce
-
critical 9.8 Material Dashboard
-
high 8.8 MDJM Event Management
-
critical 9.8 Sunshine Photo Cart
-
medium 4.3 King Addons for Elementor
-
high 7.1 Primer MyData for Woocommerce
-
high 8.1 JS Help Desk
-
critical 10.0 JS Help Desk
-
high 7.5 JS Help Desk
-
critical 9.9 RTMKit for Elementor
-
critical 9.8 Essential Real Estate
-
high 7.5 JS Help Desk
-
critical 9.1 JS Help Desk
-
critical 9.3 Quads Ads Manager for Google AdSense
-
critical 9.8 WP Travel Engine
-
high 7.5 Chat Widget
-
high 7.1 Hostel
-
high 7.1 WP2LEADS
-
high 7.1 Event Tickets and Registration
-
high 7.5 Houzez Property Feed
-
high 7.1 WP Extended
-
critical 9.8 Quiz Maker by AYS
-
medium 4.1 Gutentor
-
high 8.8 Vitepos
-
high 7.5 Awesome Support
-
high 8.8 WP Ultimate CSV Importer
-
high 8.1 WP Ultimate CSV Importer
Monday, March 31, 2025 · 23
-
medium 5.9 Media Library Assistant
-
high 7.1 PostmarkApp Email Integrator
-
high 7.1 affects latest 1.6.4 Simple Contact Forms
-
medium 6.5 affects latest 1.0.0 CookieHint WP
-
medium 4.8 SP Blog Designer
-
medium 4.3 WPCargo Track & Trace
-
medium 4.3 Apimo Connector
-
medium 6.5 Timeline Event History
-
medium 6.6 Appointify
-
medium 4.3 PostmarkApp Email Integrator
-
medium 6.5 Themesflat Addons For Elementor
-
medium 6.5 IMPress for IDX Broker
-
medium 6.5 OSM
-
high 8.5 My auctions allegro
-
medium 4.3 Swiss Toolkit For WP
-
medium 4.3 Swiss Toolkit For WP
-
medium 6.5 Group Chat & Video Chat by AtomChat
-
high 8.5 Behance Portfolio Manager
-
medium 6.5 Cost Calculator Builder
-
medium 4.3 WP Docs
-
high 7.5 InstaWP Connect
-
high 7.5 Quads Ads Manager for Google AdSense
-
medium 6.1 Photo Gallery by 10Web
Ran a vulnerable version? Check your site for signs of a hack
The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.
Browse vulnerabilities
Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution
Where this data comes from
- Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Plugin versions, update dates and install counts: the wordpress.org Plugins API.
- These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.