WordPress plugin vulnerabilities: week 23, 2025
78 vulnerabilities published Jun 2 – Jun 8, 2025 in 73 plugins we track, by day.
1 critical 12 high 65 medium
Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.
“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.
Saturday, June 7, 2025 · 5
-
medium 5.4 Event Booking Manager for WooCommerce
-
medium 6.1 Social Sharing Plugin
-
medium 5.4 Essential Addons for Elementor
-
medium 5.4 Essential Addons for Elementor
-
high 8.8 MaxiBlocks Builder
Friday, June 6, 2025 · 57
-
medium 5.9 Simple Membership
-
medium 6.6 Agile Store Locator
-
high 7.6 Agile Store Locator
-
medium 4.3 WP Time Slots Booking Form
-
high 7.6 GamiPress
-
high 8.5 Hydra Booking
-
medium 6.5 Event Countdown for The Events Calendar
-
high 7.6 افزونه پیامک ووکامرس
-
medium 6.5 Frontend Dashboard
-
high 7.5 WP Multilang
-
high 7.5 WP Travel Engine
-
medium 6.5 Event Post
-
medium 6.5 Greenshift
-
medium 4.3 User Profile Builder
Security issue
-
high 8.8 Calculated Fields Form
-
medium 4.3 WPLP Cookie Consent
-
medium 4.3 WebToffee WooCommerce Product Feeds
-
medium 4.3 WP Table Builder
-
medium 4.3 Invisible Anti-Spam & CAPTCHA
-
medium 4.3 Trinity Audio
-
medium 5.3 WP-CRM System
-
medium 6.5 Shortcodes Ultimate
-
medium 5.4 Sina Extension for Elementor
-
high 7.6 WC Vendors
-
medium 4.3 Everest Backup
-
medium 5.3 oik
-
medium 6.5 RTMKit for Elementor
-
medium 4.3 CubeWP Framework
-
medium 6.5 Premium Packages
-
medium 4.9 Nexa Blocks
-
medium 4.3 affects latest 1.5 Simple Keyword to Link
-
medium 4.7 WP Gravity Forms Constant Contact Plugin
-
medium 6.5 Nexa Blocks
-
medium 6.5 BlockStrap Page Builder
-
medium 5.3 Taskbuilder
-
medium 5.3 診断ジェネレータ作成プラグイン
-
medium 5.4 WP Compress for MainWP
-
medium 5.4 Accessibility Suite by Ability, Inc
-
medium 4.3 Behance Portfolio Manager
-
medium 4.3 WordLift
-
medium 4.3 HR Management Lite
-
medium 5.4 affects latest 1.0.4 Pay with Contact Form 7
-
medium 4.3 6Storage Rentals
-
medium 4.9 Simple History
-
medium 6.5 Ocean Extra
-
medium 6.5 The Plus Addons for Elementor
-
medium 6.5 WidgetKit for Elementor
-
high 7.1 affects latest 1.7.0 Real Time Validation for Gravity Forms
-
medium 4.3 affects latest 1.7.0 Real Time Validation for Gravity Forms
-
medium 5.4 Responsive Starter Templates
-
medium 6.4 Knowledge Base
-
medium 5.4 Stop Spammers Classic
-
medium 5.3 Modern Events Calendar Lite
Security issue
Thursday, June 5, 2025 · 2
-
critical 9.8 Uncanny Automator
-
medium 6.4 Forminator Forms
Wednesday, June 4, 2025 · 1
-
high 8.8 Sunshine Photo Cart
Tuesday, June 3, 2025 · 9
-
medium 6.4 User Profile Builder
-
medium 6.4 Popup Maker
-
high 7.2 Shared Files
-
medium 6.4 WP Plugin Info Card
-
medium 6.4 File Manager
-
medium 4.9 Ultimate Gift Cards for WooCommerce
-
medium 4.8 Newsletter
-
medium 4.3 Broken Link Checker
-
medium 5.6 Ninja Tables
Monday, June 2, 2025 · 4
-
medium 6.4 Comments Import & Export
-
medium 6.5 Booking and Rental Manager for Bike
-
medium 4.8 Real Cookie Banner
-
medium 4.1 WP-Optimize
Ran a vulnerable version? Check your site for signs of a hack
The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.
Browse vulnerabilities
Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution
Where this data comes from
- Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Plugin versions, update dates and install counts: the wordpress.org Plugins API.
- These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.