WordPress plugin vulnerabilities: week 31, 2025

28 vulnerabilities published Jul 28 – Aug 3, 2025 in 25 plugins we track, by day.

4 high 24 medium

Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.

“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.

Saturday, August 2, 2025 · 6

• medium 4.3 Ultimate Addons for Elementor

  Missing authorization check

  CVE-2025-8488 · affected 2.4.6 and older · fixed in 2.4.7 *

• medium 5.3 BitFire Security

  Information disclosure

  CVE-2025-6722 · affected 4.5 and older · fixed in 4.6.1 *

• medium 6.1 All in One Time Clock Lite

  Reflected cross-site scripting (XSS)

  CVE-2025-6832 · affected 2.0 and older · fixed in 2.0.1 *

• medium 5.3 WP CTA

  Missing authorization check

  CVE-2025-8152 · affected 1.7.0 and older · fixed in 1.7.4 *

• medium 4.4 ShortPixel Adaptive Images

  Stored cross-site scripting (XSS)

  CVE-2025-6626 · affected 3.10.4 and older · fixed in 3.10.5 *

• medium 6.4 Qi Addons For Elementor

  Stored cross-site scripting (XSS)

  CVE-2025-8146 · affected 1.9.2 and older · fixed in 1.9.3 *

Friday, August 1, 2025 · 8

• medium 6.4 Sina Extension for Elementor

  Stored cross-site scripting (XSS)

  CVE-2025-6228 · affected 3.7.0 and older · fixed in 3.7.1 *

• medium 6.4 BlockSpare

  Stored cross-site scripting (XSS)

  CVE-2025-4684 · affected 3.2.13.1 and older · fixed in 3.3.3 *

• medium 6.4 The Plus Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2025-7646 · affected 6.3.10 and older · fixed in 6.3.11 *

• medium 5.8 SureForms

  Reflected cross-site scripting (XSS)

  CVE-2025-5921 · affected older than 1.7.2 · fixed in 1.7.2

• medium 6.4 Stratum Widgets for Elementor

  Stored cross-site scripting (XSS)

  CVE-2025-7845 · affected 1.6.0 and older · fixed in 1.6.1 *

• high 7.2 Contest Gallery

  Stored cross-site scripting (XSS)

  CVE-2025-7725 · affected 26.1.0 and older · fixed in 26.1.2 *

• medium 6.5 IDonate

  Missing authorization check

  CVE-2025-4523 · affected 2.0.0 to 2.1.9 · fixed in 2.1.10 *

• high 8.1 BerqWP

  Arbitrary file upload

  CVE-2025-7443 · affected 2.2.42 and older · fixed in 2.2.44 *

Thursday, July 31, 2025 · 6

• medium 4.3 HT Mega Addons for Elementor

  Information disclosure

  CVE-2025-8401 · affected 2.9.1 and older · fixed in 2.9.2 *

• medium 4.3 HT Mega Addons for Elementor

  Path traversal / file read

  CVE-2025-8151 · affected 2.9.1 and older · fixed in 2.9.2 *

• medium 4.3 HT Mega Addons for Elementor

  Missing authorization check

  CVE-2025-8068 · affected 2.9.1 and older · fixed in 2.9.2 *

• medium 5.4 GiveWP

  Stored cross-site scripting (XSS)

  CVE-2025-7205 · affected 4.5.0 and older · fixed in 4.6.1 *

• high 8.8 AI Engine

  Arbitrary file upload

  CVE-2025-7847 · affected 2.9.3 to 2.9.4 · fixed in 2.9.5 *

• medium 6.4 Customer Reviews for WooCommerce

  Stored cross-site scripting (XSS)

  CVE-2025-5720 · affected 5.80.2 and older · fixed in 5.81.0 *

Wednesday, July 30, 2025 · 1

• medium 4.9 Smart Slider 3

  SQL injection

  CVE-2025-6348 · affected 3.5.1.28 and older · fixed in 3.5.1.29 *

Tuesday, July 29, 2025 · 7

• medium 6.4 MetForm

  Stored cross-site scripting (XSS)

  CVE-2025-5684 · affected 4.0.1 and older · fixed in 4.0.2 *

• medium 6.4 Magical Addons For Elementor ( Theme Builder,…

  Stored cross-site scripting (XSS)

  CVE-2025-8196 · affected 1.3.8 and older · fixed in 1.5.3 *

• medium 6.4 Sky Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2025-8216 · affected 3.1.4 and older · fixed in 3.2.0 *

• high 8.8 Hydra Booking

  Privilege escalation

  CVE-2025-7689 · affected 1.1.0 to 1.1.18 · fixed in 1.1.19 *

• medium 5.3 Brizy

  Missing authorization check

  CVE-2025-4370 · affected 2.6.20 and older · fixed in 2.6.21 *

• medium 6.4 Elementor Website Builder

  Stored cross-site scripting (XSS)

  CVE-2025-4566 · affected 3.30.2 and older · fixed in 3.30.3 *

• medium 5.4 Elementor Website Builder

  Stored cross-site scripting (XSS)

  CVE-2025-3075 · affected 3.29.0 and older · fixed in 3.29.1 *

Ran a vulnerable version? Check your site for signs of a hack

The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.

Scan free

Browse vulnerabilities

• Published this week
• Unpatched in the latest version
• By type of vulnerability

Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution

Where this data comes from

• Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
• Plugin versions, update dates and install counts: the wordpress.org Plugins API.
• These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.

← Check a plugin · Free hacked-site scan