WordPress plugin vulnerabilities: week 29, 2025
45 vulnerabilities published Jul 14 – Jul 20, 2025 in 38 plugins we track, by day.
10 critical 10 high 25 medium
Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.
“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.
Saturday, July 19, 2025 · 2
-
high 7.2 Subscribe to Comments
-
critical 9.8 WPshop 2
Friday, July 18, 2025 · 3
-
medium 4.4 Terms descriptions
-
medium 4.9 Forminator Forms
-
medium 4.4 Knowledge Base
Wednesday, July 16, 2025 · 36
-
high 7.1 Tennis Court Bookings
-
high 7.1 affects latest 1.0.4 Pay with Contact Form 7
-
high 8.5 ProfileGrid
-
high 7.1 Contest Gallery
-
high 7.6 FunnelKit
-
critical 9.1 Groundhogg
-
medium 6.5 Wishlist for WooCommerce
-
high 7.1 Infility Global
-
critical 9.8 affects latest 1.4.3 CoSchool LMS
-
high 8.6 URL Shortener Plugin For WordPress
-
critical 9.8 URL Shortener Plugin For WordPress
-
critical 9.3 Torod
-
critical 9.3 URL Shortener Plugin For WordPress
-
critical 9.3 WP-BusinessDirectory
-
medium 6.5 All In One Lightbox
-
medium 5.4 Responsive Addons for Elementor
-
medium 5.4 Restaurant Menu and Food Ordering
-
medium 5.4 News Kit Addons For Elementor
-
medium 4.3 Wallet System for WooCommerce
-
medium 4.3 Newsletters
-
medium 4.3 Easy Appointment Booking & Scheduling Plugin
-
medium 6.5 WPAdverts
-
medium 6.5 WP Delicious
-
medium 6.5 Coupon Affiliates
-
medium 6.5 Bold Page Builder
-
medium 6.6 HT Contact Form
-
medium 4.3 SMTP2GO for WordPress
-
medium 5.9 Welcart e-Commerce
-
high 7.2 JetFormBuilder
-
medium 6.5 Easy Elementor Addons
-
medium 6.4 Master Addons for Elementor
-
medium 5.4 Media Library Assistant
-
medium 6.1 WP Event Manager
-
medium 4.8 WP Event Manager
-
medium 6.1 ProfileGrid
Tuesday, July 15, 2025 · 4
-
critical 9.8 HT Contact Form
-
medium 6.4 Strong Testimonials
-
critical 9.8 HT Contact Form
-
critical 9.8 HT Contact Form
Ran a vulnerable version? Check your site for signs of a hack
The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.
Browse vulnerabilities
Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution
Where this data comes from
- Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Plugin versions, update dates and install counts: the wordpress.org Plugins API.
- These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.