WordPress plugin vulnerabilities: week 39, 2025
141 vulnerabilities published Sep 22 – Sep 28, 2025 in 123 plugins we track, by day.
3 critical 15 high 120 medium 3 low
Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.
“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.
Saturday, September 27, 2025 · 3
-
high 7.2 WP Statistics
-
medium 4.3 Ninja Forms
-
medium 5.4 Ninja Forms
Friday, September 26, 2025 · 37
-
medium 5.4 Silencesoft RSS Reader
-
high 7.1 NewsmanApp
-
critical 9.6 AR for WordPress
-
medium 6.5 Customer Support Ticket System & Helpdesk
-
medium 4.3 Netgsm
-
medium 5.9 The Tribal Plugin
-
medium 5.3 The Tribal Plugin
-
medium 4.3 HivePress Claim Listings
-
medium 4.3 HivePress Claim Listings
-
medium 5.3 WP Directory Kit
-
medium 4.3 Instapage Plugin
-
medium 6.5 aThemes Addons for Elementor
-
medium 6.6 YayCurrency
-
medium 6.5 Ditty
-
medium 4.9 EmailKit
-
medium 5.9 Gallery Custom Links
-
medium 6.5 Embed Any Document
-
medium 6.5 Theme My Login
-
medium 4.3 Download Manager
-
medium 5.3 Download Manager
-
medium 4.3 Stackable
-
medium 4.3 Stackable
-
high 7.5 Permalink Manager Lite
-
high 7.1 ProfileGrid
-
medium 6.5 Authorsy
-
medium 4.4 Zephyr Project Manager
-
medium 6.5 Backuply
-
medium 6.4 Popup Maker
-
high 7.2 WP-DownloadManager
-
medium 5.3 Featured Image from URL (FIFU)
-
medium 5.3 Featured Image from URL (FIFU)
-
medium 4.9 Featured Image from URL (FIFU)
-
medium 4.9 Featured Image from URL (FIFU)
-
medium 6.4 Mapster WP Maps
-
low 2.7 ShopEngine
-
medium 4.3 OAuth Single Sign On
-
medium 6.4 CM Business Directory
Wednesday, September 24, 2025 · 1
-
medium 6.4 Themify Builder
Tuesday, September 23, 2025 · 7
-
medium 5.9 WordPress
-
medium 4.3 WordPress
-
critical 9.8 Podlove Podcast Publisher
-
low 3.5 SureForms
-
critical 9.8 WPCasa
-
high 8.8 Advanced Views
Security issue
-
medium 6.5 Request a Quote
Monday, September 22, 2025 · 93
-
medium 5.9 Media Library Assistant
-
medium 4.3 Comments
-
medium 5.3 Ajax Load More
-
medium 6.5 Ibtana
-
medium 4.3 MasterStudy LMS WordPress Plugin
Security issue
-
medium 5.3 Cozy Blocks
-
medium 6.5 CubeWP Framework
-
high 7.6 Mail Mint
-
medium 6.5 MasterStudy LMS WordPress Plugin
-
medium 5.5 Academy LMS
-
medium 6.5 Upsell Funnel Builder for WooCommerce
-
medium 5.5 Coupon Affiliates
-
medium 4.3 Zoho Flow
-
medium 4.3 Revive.so
-
medium 6.5 Save as PDF Plugin by PDFCrowd
-
high 7.5 Easy Elementor Addons
-
medium 5.0 MaxiBlocks Builder
-
medium 6.5 WPComplete
-
medium 6.5 MarketKing
-
medium 4.3 VPSUForm
-
high 7.1 Doliconnect
-
medium 6.5 Logo Showcase
-
high 8.5 Perfect Brands for WooCommerce
-
medium 6.5 Accordions
-
medium 5.3 AppMySite
-
medium 6.5 Gutentor
-
medium 5.4 User Frontend
-
medium 5.4 User Frontend
-
high 7.2 Awesome Support
-
medium 4.3 affects latest 1.8.14 Qubely
-
medium 5.4 All in One SEO
-
medium 4.3 All in One SEO
-
medium 6.5 Simple JWT Login
-
medium 5.3 Project Manager
Security issue
-
medium 6.5 Highlight and Share
-
medium 6.5 Jupiter X Core
-
medium 4.3 Custom Block Builder
-
high 7.1 Sweet Energy Efficiency
-
medium 4.3 Getwid
-
medium 6.5 Real Estate Manager
-
medium 4.3 affects latest 1.8.14 Qubely
-
medium 4.3 Sticky Header Effects for Elementor
-
medium 5.3 TI WooCommerce Wishlist
-
medium 6.5 Connector Wizard (formerly LC Wizard)
-
medium 6.5 PilotPress
-
medium 6.5 SQL Chart Builder
-
medium 5.3 3D FlipBook
-
medium 5.4 Printeers Print & Ship
-
medium 6.5 Quick View for WooCommerce
-
medium 4.3 PilotPress
-
medium 6.5 Nextend Social Login and Register
-
medium 6.5 NGG Smart Image Search
-
medium 6.5 Page-list
-
medium 5.4 Master Slider
-
medium 6.5 Search Atlas SEO
-
medium 6.5 Theater for WordPress
-
high 7.5 Quiz Maker by AYS
-
medium 4.3 Quiz Maker by AYS
-
medium 6.5 Ultimate Store Kit
-
low 3.8 CP Multi View Events Calendar
-
medium 6.5 Participants Database
-
medium 4.3 Hubbub Lite
-
medium 4.7 WP Gravity Forms Keap/Infusionsoft
-
medium 5.3 Memberful
-
medium 6.5 WPKoi Templates for Elementor
-
medium 6.5 Uncanny Toolkit for LearnDash
-
medium 4.3 Team
-
medium 5.3 Manago AI & Leadoo AI
-
medium 4.3 Manago AI & Leadoo AI
-
medium 5.5 WP-Members Membership Plugin
-
medium 6.5 Open User Map
-
medium 6.5 Poll Maker by AYS
-
medium 6.5 Photo Gallery by Ays
-
medium 5.9 affects latest 1.1.7 WP Advanced PDF
-
medium 6.5 Easy Hotel
-
medium 4.3 Emergency password reset
-
medium 4.3 WPeMatico RSS Feed Fetcher
-
medium 4.3 Double the Donation
-
medium 5.9 Double the Donation
-
medium 5.3 AWP Classifieds
-
medium 6.5 Passster
-
medium 5.3 Frontend File Manager Plugin
-
medium 4.3 Printcart Store
-
medium 6.5 Behance Portfolio Manager
-
medium 6.5 GutenKit
-
medium 5.3 WP Compress
-
medium 5.9 Better Find and Replace
-
medium 5.4 No External Links
-
medium 4.7 Admin and Site Enhancements (ASE)
Ran a vulnerable version? Check your site for signs of a hack
The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.
Browse vulnerabilities
Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution
Where this data comes from
- Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Plugin versions, update dates and install counts: the wordpress.org Plugins API.
- These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.