WordPress plugin vulnerabilities: week 44, 2025
87 vulnerabilities published Oct 27 – Nov 2, 2025 in 81 plugins we track, by day.
4 critical 8 high 73 medium 2 low
Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.
“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.
Saturday, November 1, 2025 · 16
-
high 8.8 WP Delicious
-
medium 4.9 Import WP
-
critical 9.8 Tablesome Table
-
high 7.3 Advanced Ads
-
medium 6.4 Employee Spotlight
-
medium 4.3 Qi Blocks
-
medium 6.5 wpForo Forum
-
medium 6.4 Schema & Structured Data for WP & AMP
-
high 7.2 Community Events
-
medium 4.3 List category posts
-
medium 4.3 SiteSEO
-
medium 4.4 CSS & JavaScript Toolbox
-
critical 9.8 Post SMTP
-
high 8.8 WPCOM Member
-
medium 5.3 Document Library Lite
Friday, October 31, 2025 · 14
-
medium 6.5 Groundhogg
-
high 7.6 MasterStudy LMS WordPress Plugin
-
medium 4.3 Smart Coupons For WooCommerce Coupons
-
low 2.7 Essential Addons for Elementor
-
medium 6.5 Gutenberg
-
high 8.8 Polylang
-
medium 4.3 Rank Math SEO
-
low 3.8 Rank Math SEO
-
medium 4.3 Depicter
-
medium 5.3 oopspam Anti-Spam
Security issue
-
medium 4.3 The Events Calendar
-
critical 9.8 King Addons for Elementor
-
medium 5.3 RealPress
-
medium 4.3 FuseWP
Thursday, October 30, 2025 · 1
Wednesday, October 29, 2025 · 17
-
medium 6.1 LiteSpeed Cache
-
medium 5.9 Premmerce User Roles
-
medium 4.3 Premmerce
-
medium 4.3 Premmerce Product Search for WooCommerce
-
medium 5.9 Premmerce Product Search for WooCommerce
-
high 7.5 Majestic Support
-
medium 5.4 Premmerce Wholesale Pricing for WooCommerce
-
medium 6.5 RTMKit for Elementor
-
medium 4.3 Sprout Invoices
-
medium 4.3 Business Directory Plugin
-
medium 4.3 PowerPress Podcasting plugin by Blubrry
-
medium 5.9 Mailonix
-
medium 5.3 WooCommerce
-
medium 5.9 WooCommerce
-
medium 5.3 Meta for WooCommerce
-
medium 5.3 Popup Box
Tuesday, October 28, 2025 · 1
-
high 7.5 HUSKY
Monday, October 27, 2025 · 38
-
medium 5.4 IDonate
-
medium 6.5 Builderall for WordPress
-
medium 5.9 Dynamic User Directory
-
medium 4.9 affects latest 1.0.3 Slider Templates
-
medium 5.3 ACF to REST API
-
medium 4.7 WP Gravity Forms Zoho CRM and Bigin
-
medium 4.3 KiotViet Sync
-
medium 5.3 BuddyForms
-
medium 6.5 DirectoryPress
-
medium 5.3 Link Whisper Free
-
medium 6.5 NextMove Lite
-
medium 6.5 WP Last Modified Info
-
medium 6.5 Estatik Real Estate Plugin
-
critical 9.1 Paid Videochat Turnkey Site
-
medium 5.3 MDTF
-
medium 4.3 WPBot
-
medium 6.5 Interactive Content
-
medium 4.3 Welcart e-Commerce
-
medium 5.3 Everest Backup
-
medium 6.5 MapSVG
-
medium 6.5 Nelio Content
-
medium 6.5 Post Grid
-
medium 6.5 Testimonial
-
medium 6.5 Marquee Addons for Elementor
-
medium 6.5 SiteGround Email Marketing
-
medium 6.5 WPC Smart Messages for WooCommerce
-
medium 5.3 Atarim
-
medium 4.3 Off-Canvas Sidebars & Menus (Slidebars)
-
medium 5.3 Sunshine Photo Cart
-
medium 5.3 WP Recipe Maker
-
medium 6.5 King Addons for Elementor
-
medium 6.5 King Addons for Elementor
-
medium 4.3 Premmerce User Roles
-
medium 4.3 Premmerce Brands for WooCommerce
-
medium 5.3 Coupon Affiliates
-
medium 6.5 WPVR
-
medium 4.3 Seriously Simple Podcasting
-
medium 4.3 WP-Lister Lite for eBay
Ran a vulnerable version? Check your site for signs of a hack
The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.
Browse vulnerabilities
Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution
Where this data comes from
- Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Plugin versions, update dates and install counts: the wordpress.org Plugins API.
- These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.