WordPress plugin vulnerabilities: week 43, 2025
91 vulnerabilities published Oct 20 – Oct 26, 2025 in 84 plugins we track, by day.
5 critical 26 high 57 medium 3 low
Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.
“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.
Saturday, October 25, 2025 · 23
-
medium 6.3 Discussion Board
-
high 7.5 Stripe Payment Forms by WP Full Pay
-
high 7.5 wpForo Forum
-
medium 6.5 Charitable
-
medium 4.4 Fast Velocity Minify
-
medium 4.3 FuseWP
-
medium 5.3 Social Feed Gallery
-
medium 6.4 Widget Options
-
high 8.1 Directorist
-
medium 4.3 Tutor LMS
-
medium 5.4 Tutor LMS
-
medium 6.5 GenerateBlocks
-
low 2.7 ShopEngine
-
medium 5.3 Tutor LMS
-
medium 5.3 Product Filter for WooCommerce by WBW
-
medium 4.3 WPVR
-
low 3.7 Password Protected
-
high 7.2 Watu Quiz
-
medium 5.3 UserFeedback
-
medium 5.3 BackWPup
-
medium 5.4 ShopLentor
-
medium 5.3 eRoom
Friday, October 24, 2025 · 6
-
medium 6.8 Real Cookie Banner
-
medium 6.3 URL Shortener Plugin For WordPress
-
medium 6.8 Jeg Kit for Elementor
-
medium 5.5 Orbit Fox
-
low 2.7 PixelYourSite
Thursday, October 23, 2025 · 3
-
medium 6.4 Bold Page Builder
-
medium 5.0 RSS Aggregator by Feedzy
-
medium 5.3 MxChat
Wednesday, October 22, 2025 · 57
-
medium 4.3 MeetingHub
-
medium 6.5 E2Pdf
-
medium 5.5 Easy Post Submission
-
medium 4.3 WowRevenue
-
medium 6.5 MDTF
-
medium 6.5 WP Travel Gutenberg Blocks
-
medium 4.3 BlockSpare
-
medium 6.5 Event Post
-
medium 5.4 Event Tickets and Registration
-
medium 5.4 SmartCrawl SEO checker, analyzer & optimizer
-
high 7.6 Advanced Coupons for WooCommerce
-
high 7.5 BuddyPress
-
medium 6.5 Recipe Card Blocks Lite
-
critical 9.0 s2Member
-
high 7.1 VOD Infomaniak
-
medium 4.3 UiChemy
-
medium 5.4 WSMS (formerly WP SMS)
-
critical 9.8 Captivate Sync
-
medium 4.7 WP Gravity Forms HubSpot
-
high 7.1 HotelRunner Booking Widget
-
medium 5.9 Colibri Page Builder
-
medium 5.8 ShopMagic
-
medium 4.9 MasterStudy LMS WordPress Plugin
-
high 8.8 MemberHero
-
high 7.2 Dokan
-
medium 6.5 Accordions
-
medium 5.8 APPExperts
-
medium 5.8 affects latest 1.0.7 WP Gmail SMTP
-
high 7.1 Contact Form by Supsystic
-
high 7.4 WP Last Modified Info
-
critical 9.1 affects latest 1.7.0 Zippy
-
high 7.1 Finale Lite
-
high 7.1 LearnPress
-
high 7.1 affects latest 2.24.0 NextMove Lite
-
high 8.8 WP Store Locator
-
medium 6.5 LeadBI Plugin for WordPress
-
medium 4.3 Smash Balloon Social Post Feed
-
medium 5.9 Seriously Simple Podcasting
-
high 7.2 Wholesale Suite
-
medium 4.3 WPeMatico RSS Feed Fetcher
-
medium 5.4 Web Accessibility by accessiBe
-
high 8.6 MultiVendorX
-
critical 9.3 SMS Alert
-
medium 4.3 MDTF
-
medium 5.3 WPComplete
-
high 8.2 One to one user Chat by WPGuppy
-
high 8.5 Hydra Booking
-
medium 6.3 Hydra Booking
-
high 7.1 Survey Maker by AYS
-
medium 5.9 Survey Maker by AYS
-
high 8.5 AnyComment
-
high 8.8 Progress Planner
-
medium 4.3 All in One Time Clock Lite
-
medium 4.3 PixelYourSite
-
medium 4.3 Flexible Refund for WooCommerce
-
medium 5.5 Welcart e-Commerce
Tuesday, October 21, 2025 · 1
-
critical 9.1 FormGent
Monday, October 20, 2025 · 1
Ran a vulnerable version? Check your site for signs of a hack
The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.
Browse vulnerabilities
Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution
Where this data comes from
- Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Plugin versions, update dates and install counts: the wordpress.org Plugins API.
- These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.