WordPress plugin vulnerabilities: week 28, 2025

25 vulnerabilities published Jul 7 – Jul 13, 2025 in 19 plugins we track, by day.

3 critical 5 high 17 medium

Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.

“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.

Saturday, July 12, 2025 · 6

• critical 9.8 Modern Events Calendar Lite

  SQL injection

  CVE-2021-4458 · affected 6.3.0 and older · fix not stated

• high 7.5 Total Upkeep

  Information disclosure

  CVE-2020-36848 · affected 1.14.9 and older · fixed in 1.14.10 *

• medium 4.9 RSFirewall!

  Path traversal / file read

  CVE-2025-7518 · affected 1.1.42 and older · fix not stated

• critical 9.8 Simple File List

  Remote code execution

  CVE-2020-36847 · affected older than 4.2.3 · fixed in 4.2.3

• critical 9.8 WPBookit

  Arbitrary file upload

  CVE-2025-6058 · affected 1.0.4 and older · fixed in 1.0.5 *

• high 8.8 WPBookit

  Arbitrary file upload

  CVE-2025-6057 · affected 1.0.4 and older · fixed in 1.0.5 *

Friday, July 11, 2025 · 5

• medium 6.5 Broken Link Notifier

  Server-side request forgery (SSRF)

  CVE-2025-6851 · affected 1.3.0 and older · fixed in 1.3.7.6 *

• medium 4.1 Broken Link Notifier

  CSV injection

  CVE-2025-6838 · affected 1.3.0 and older · fixed in 1.3.7.6 *

• medium 5.4 FooGallery Photo Gallery

  Stored cross-site scripting (XSS)

  CVE-2025-6068 · affected 2.4.31 and older · fixed in 2.4.32 *

• medium 6.4 Contest Gallery

  Stored cross-site scripting (XSS)

  CVE-2025-6716 · affected 26.0.8 and older · fixed in 26.1.2 *

• medium 5.9 GeoDirectory

  Stored cross-site scripting (XSS)

  CVE-2025-6200 · affected older than 2.8.120 · fixed in 2.8.120

Thursday, July 10, 2025 · 4

• medium 4.8 Hostel

  Stored cross-site scripting (XSS)

  CVE-2025-6236 · affected older than 1.1.5.9 · fixed in 1.1.5.9

• medium 6.1 Hostel

  Reflected cross-site scripting (XSS)

  CVE-2025-6234 · affected older than 1.1.5.8 · fixed in 1.1.5.8

• medium 6.1 Gwolle Guestbook

  Stored cross-site scripting (XSS)

  CVE-2025-5807 · affected 4.9.2 and older · fixed in 4.9.3 *

• medium 5.4 wpForo Forum

  Stored cross-site scripting (XSS)

  CVE-2025-4406 · affected 2.4.5 and older · fixed in 2.4.6 *

Wednesday, July 9, 2025 · 7

• medium 5.4 Events Manager

  Stored cross-site scripting (XSS)

  CVE-2025-6976 · affected 6.6.4.4 and older, 7.0.1 to 7.0.3 · fixed in 7.0.4 *

• medium 6.1 Events Manager

  Reflected cross-site scripting (XSS)

  CVE-2025-6975 · affected 6.6.4.4 and older, 7.0.1 to 7.0.3 · fixed in 7.0.4 *

• high 7.5 Events Manager

  SQL injection

  CVE-2025-6970 · affected 6.6.4.4 and older, 7.0.1 to 7.0.3 · fixed in 7.0.4 *

• high 7.5 SureForms

  PHP object injection

  CVE-2025-6742 · affected 0.0 to 0.0.13, 1.0 to 1.0.6, 1.1 to 1.1.1, 1.2 to 1.2.4, 1.3 to 1.3.1, 1.4 to 1.4.4, 1.5 only, 1.6 to 1.6.4, 1.7 to 1.7.3 · fixed in 1.7.4 *

• high 8.1 SureForms

  Arbitrary file deletion

  CVE-2025-6691 · affected 0.0 to 0.0.13, 1.0 to 1.0.6, 1.1 to 1.1.1, 1.2 to 1.2.4, 1.3 to 1.3.1, 1.4 to 1.4.4, 1.5 only, 1.6 to 1.6.4, 1.7 to 1.7.3 · fixed in 1.7.4 *

• medium 5.4 Kadence Blocks

  Stored cross-site scripting (XSS)

  CVE-2025-5678 · affected 3.5.10 and older · fixed in 3.5.11 *

• medium 6.5 WCFM

  Missing authorization check

  CVE-2025-3780 · affected 6.7.16 and older · fixed in 6.7.17 *

Tuesday, July 8, 2025 · 3

• medium 5.3 Guest Support

  Missing authorization check

  CVE-2025-5957 · affected 1.2.2 and older · fixed in 1.2.3 *

• medium 5.4 AI Engine

  Stored cross-site scripting (XSS)

  CVE-2025-5570 · affected 2.8.4 and older · fixed in 2.8.5 *

• medium 5.4 Essential Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2025-6244 · affected 6.1.19 and older · fixed in 6.1.20 *

Ran a vulnerable version? Check your site for signs of a hack

The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.

Scan free

Browse vulnerabilities

• Published this week
• Unpatched in the latest version
• By type of vulnerability

Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution

Where this data comes from

• Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
• Plugin versions, update dates and install counts: the wordpress.org Plugins API.
• These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.

← Check a plugin · Free hacked-site scan