WordPress plugin vulnerabilities: week 30, 2025

21 vulnerabilities published Jul 21 – Jul 27, 2025 in 18 plugins we track, by day.

4 critical 5 high 12 medium

Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.

“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.

Saturday, July 26, 2025 · 3

• medium 6.4 Advanced iFrame

  Stored cross-site scripting (XSS)

  CVE-2025-6987 · affected 2025.5 and older · fixed in 2025.6 *

• medium 4.3 WPeMatico RSS Feed Fetcher

  Cross-site request forgery (CSRF)

  CVE-2025-8103 · affected 2.8.7 and older · fixed in 2.8.27 *

• high 7.5 GeoDirectory

  SQL injection

  CVE-2024-13507 · affected 2.8.97 and older · fixed in 2.8.98 *

Friday, July 25, 2025 · 3

• high 7.5 Frontend File Manager Plugin

  Missing authorization check

  CVE-2023-7306 · affected 21.5 and older · fix not stated

• critical 9.8 WP Database Backup

  Command injection

  CVE-2019-25224 · affected older than 5.2 · fixed in 5.2

• high 8.8 Responsive Thumbnail Slider

  Arbitrary file upload

  CVE-2015-10144 · affected older than 1.0.1 · fixed in 1.0.1

Thursday, July 24, 2025 · 6

• medium 5.4 ElementsKit Elementor Addons

  Stored cross-site scripting (XSS)

  CVE-2025-3614 · affected 3.5.2 and older · fixed in 3.5.3 *

• medium 6.5 AI Engine

  Information disclosure

  CVE-2025-7780 · affected 2.9.4 and older · fixed in 2.9.5 *

• critical 9.8 WebinarIgnition

  Authentication bypass

  CVE-2025-6441 · affected 4.03.32 and older · fixed in 4.03.33 *

• medium 6.4 Structured Content (JSON-LD) #wpsc

  Stored cross-site scripting (XSS)

  CVE-2025-4608 · affected 1.6.4 and older · fixed in 1.7.0 *

• critical 9.8 WPBookit

  Arbitrary file upload

  CVE-2025-7852 · affected 1.0.6 and older · fixed in 1.0.7 *

• critical 9.8 Ebook Store

  Arbitrary file upload

  CVE-2025-7437 · affected 5.8012 and older · fixed in 6.20 *

Tuesday, July 22, 2025 · 5

• medium 6.4 Shortcodes Ultimate

  Stored cross-site scripting (XSS)

  CVE-2025-8015 · affected 7.4.2 and older · fixed in 7.4.3 *

• high 8.8 Ajax Load More

  Missing authorization check

  CVE-2015-10140 · affected older than 2.8.1.2 · fixed in 2.8.1.2

• high 8.1 Extensions For CF7 (Contact form 7 Database, C…

  Arbitrary file deletion

  CVE-2025-7645 · affected 3.2.8 and older · fixed in 3.2.9 *

• medium 6.4 WP-Members Membership Plugin

  Stored cross-site scripting (XSS)

  CVE-2025-7495 · affected 3.5.4.1 and older · fixed in 3.5.4.2 *

• medium 6.4 User Registration & Membership

  Stored cross-site scripting (XSS)

  CVE-2025-6831 · affected 4.2.4 and older · fixed in 4.3.0 *

Monday, July 21, 2025 · 4

• medium 4.4 Ebook Store

  Stored cross-site scripting (XSS)

  CVE-2025-7486 · affected 5.8012 and older · fixed in 6.20 *

• medium 6.4 Gutentor

  Stored cross-site scripting (XSS)

  CVE-2025-4685 · affected 3.4.8 and older · fixed in 3.4.9 *

• medium 6.1 Shortcodes Ultimate

  Cross-site request forgery (CSRF)

  CVE-2025-7369 · affected 7.4.2 and older · fixed in 7.4.3 *

• medium 6.4 Shortcodes Ultimate

  Stored cross-site scripting (XSS)

  CVE-2025-7354 · affected 7.4.2 and older · fixed in 7.4.3 *

Ran a vulnerable version? Check your site for signs of a hack

The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.

Scan free

Browse vulnerabilities

• Published this week
• Unpatched in the latest version
• By type of vulnerability

Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution

Where this data comes from

• Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
• Plugin versions, update dates and install counts: the wordpress.org Plugins API.
• These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.

← Check a plugin · Free hacked-site scan