WordPress plugin vulnerabilities: week 21, 2025
66 vulnerabilities published May 19 – May 25, 2025 in 53 plugins we track, by day.
10 critical 14 high 42 medium
Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.
“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.
Saturday, May 24, 2025 · 7
-
medium 4.7 Page Builder
-
critical 9.8 eMagicOne Store Manager for WooCommerce
-
critical 9.1 eMagicOne Store Manager for WooCommerce
-
critical 9.8 eMagicOne Store Manager for WooCommerce
-
medium 4.4 Smart Forms
-
medium 6.4 Page Builder
Friday, May 23, 2025 · 18
-
critical 9.3 Majestic Support
-
high 7.5 WP Job Portal
-
high 7.1 Quick Contact Form
-
high 7.1 Arconix Shortcodes
-
high 8.1 miniOrange Discord Integration
-
medium 6.5 6Storage Rentals
-
critical 10.0 Printcart Store
-
critical 9.3 Printcart Store
-
high 7.5 Mail Mint
-
critical 9.8 Eventin
-
high 8.5 ProfileGrid
-
high 8.6 Tainacan
-
critical 9.8 WPFunnels
-
critical 9.8 WP Job Portal
-
medium 5.4 TablePress
Thursday, May 22, 2025 · 2
-
medium 5.4 Blog2Social
-
medium 6.1 WooCommerce
Wednesday, May 21, 2025 · 1
-
medium 6.4 Slim SEO
Tuesday, May 20, 2025 · 1
Monday, May 19, 2025 · 37
-
critical 10.0 TI WooCommerce Wishlist
-
medium 4.3 Master Slider
-
medium 4.3 Name Directory
-
medium 5.4 Salon Booking System
-
medium 6.5 TI WooCommerce Wishlist
-
medium 5.3 Masteriyo LMS
-
medium 6.5 ElementInvader Addons for Elementor
-
medium 4.3 Falang multilanguage for WordPress
-
medium 5.9 Form Maker by 10Web
-
high 7.6 AutomatorWP
-
medium 5.9 Cost Calculator Builder
-
medium 5.3 Majestic Support
-
medium 6.5 Visual Composer Website Builder
-
medium 5.4 Japanized for WooCommerce
-
medium 4.3 Bot for Telegram on WooCommerce
-
medium 5.3 WP Job Portal
-
medium 6.5 WPAdverts
-
medium 5.4 MultiVendorX
-
medium 4.3 GDPR CCPA Compliance & Cookie Consent Banner
-
medium 5.4 Free Shipping Bar
-
medium 6.5 Projectopia
-
high 8.8 Broadcast Live Video
-
medium 5.9 Exclusive Addons for Elementor
-
medium 4.3 PrettyLinks
-
medium 5.4 The Events Calendar
-
high 8.5 bunny.net
-
medium 6.5 Cost of Goods
-
medium 6.5 Legal Pages
-
medium 6.5 Wishlist for WooCommerce
-
medium 6.5 Xpro Addons For Beaver Builder
-
medium 4.8 Ninja Forms
-
medium 4.8 Ninja Forms
-
medium 4.8 Ninja Forms
-
medium 5.4 Qi Blocks
-
medium 5.4 Qi Blocks
-
medium 5.4 Qi Blocks
Ran a vulnerable version? Check your site for signs of a hack
The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.
Browse vulnerabilities
Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution
Where this data comes from
- Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Plugin versions, update dates and install counts: the wordpress.org Plugins API.
- These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.