WordPress plugin vulnerabilities: week 45, 2025
175 vulnerabilities published Nov 3 – Nov 9, 2025 in 160 plugins we track, by day.
20 critical 69 high 86 medium
Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.
“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.
Saturday, November 8, 2025 · 25
-
high 7.2 Alex Reservations
-
medium 6.4 aThemes Addons for Elementor
-
medium 6.5 CYAN Backup
-
medium 6.4 Saphali LiqPay for donate
-
medium 4.3 Envira Gallery
-
high 7.2 Mail Mint
-
medium 4.9 Quick Featured Images
-
high 7.2 Academy LMS
-
medium 5.3 Flexible Refund for WooCommerce
-
medium 4.3 EventPrime
-
high 8.8 Better Find and Replace
-
medium 5.3 Download Manager
Security issue
-
medium 6.1 Mang Board
-
medium 5.3 WPFunnels
-
medium 6.1 WP2Social Auto Publish
-
medium 4.4 HTML Forms
-
medium 6.4 Insert Headers and Footers Code
-
medium 4.3 Connect Contact Form 7 and AWeber
-
high 8.8 Smart Auto Upload Images
-
medium 5.3 Course Booking System
-
medium 4.3 Groups
-
medium 4.9 PublishPress Taxonomies
-
medium 6.5 WPFunnels
-
high 7.5 Asgaros Forum
-
medium 6.4 Simple Downloads List
Friday, November 7, 2025 · 5
-
medium 4.3 Page & Post Notes
-
medium 4.0 WP Airbnb Review Slider
-
medium 6.5 IDonate
-
high 8.8 IDonate
Thursday, November 6, 2025 · 91
-
high 7.1 Import from YML
-
critical 10.0 King Addons for Elementor
-
critical 9.8 King Addons for Elementor
-
medium 4.3 Contest Gallery
-
medium 6.5 affects latest 1.2.1 Effect Maker
-
high 7.1 Simple Payment
-
high 7.5 Simple Payment
-
high 7.1 Booster for WooCommerce
-
critical 9.9 RTMKit for Elementor
-
high 7.1 SureRank SEO
-
high 7.1 WPMobile.App
-
medium 6.5 Cost Calculator Builder
-
medium 6.5 MeetingHub
-
high 7.1 YOP Poll
-
medium 6.5 affects latest 1.2.3 Bux Woocommerce
-
high 7.1 TableOn
-
critical 9.8 affects latest 1.2.46 Selling Commander for WooCommerce
-
critical 9.8 WP User Manager
-
high 7.5 WPC Product Options for WooCommerce
-
high 7.5 AnyComment
-
high 8.5 affects latest 1.4.3 CoSchool LMS
-
high 7.5 affects latest 1.4 Download Counter
-
high 7.5 Premmerce
-
critical 10.0 Helpdesk Support Ticket System for WooCommerce
-
high 7.5 Store Toolkit
-
high 7.5 WP Customer Area
-
high 7.5 Favorites
-
high 7.5 LearnPress
-
high 7.5 Store Exporter
-
critical 9.8 Atarim
-
high 7.5 Clearblue® Ovulation Calculator
-
high 7.5 Premmerce User Roles
-
high 7.5 Premmerce Wishlist for WooCommerce
-
high 8.1 affects latest 1.6.4 Simple Contact Forms
-
high 7.5 Atarim
-
medium 4.8 Atarim
-
high 8.1 affects latest 1.3.6 Immocaster WordPress Plugin
-
high 7.5 affects latest 1.4.7 Lazy Load Optimizer
-
high 7.5 affects latest 1.2.2 Responsive Sidebar
-
high 7.5 PoloPag
-
medium 5.3 VikBooking Hotel Booking Engine & PMS
-
critical 9.1 Advanced Settings 3
-
critical 9.8 s2Member
-
high 7.2 Barcode Scanner (+Mobile App)
-
medium 6.5 Jock On Air Now (JOAN)
-
medium 5.3 All In One Login
-
high 8.8 Falang multilanguage for WordPress
-
critical 9.8 WP Gravity Forms Keap/Infusionsoft
-
high 8.1 TranslatePress
-
high 8.2 Ai Image Alt Text Generator for WP
-
high 7.1 Doliconnect
-
high 7.1 Info Cards
-
high 7.1 Gutenify
-
high 7.1 Dropify
-
high 7.1 WP GDPR Cookie Consent
-
high 7.1 affects latest 1.2 WP Logo Changer
-
medium 6.5 affects latest 0.1 Backup and Move Plugin
-
medium 6.5 affects latest 1.21 Sertifier Certificate & Badge Maker for WordPr…
-
high 7.1 affects latest 1.5.3.8 User Registration Aide
-
high 8.8 Advanced Scrollbar
-
high 7.1 Booking and Rental Manager for Bike
-
high 7.1 affects latest 1.0004 flexoslider
-
critical 9.3 HieCOR Payment Gateway Plugin
-
high 7.1 Range Slider Addon for Gravity Forms
-
high 7.1 Image Gallery Block
-
high 7.1 Cookie Notice & Consent
-
medium 6.5 Easy Appointments
-
high 8.8 Preserve Code Formatting
-
critical 9.8 Sign-up Sheets
-
medium 5.5 Ajax Search Lite
-
critical 10.0 HAPPY
-
high 7.5 affects latest 1.7.0 Real Time Validation for Gravity Forms
-
critical 9.1 Dynamic Pricing With Discount Rules for WooCom…
-
high 7.1 affects latest 1.0 Block Country
-
high 7.1 Simple Stripe
-
high 7.1 Slick Google Map
-
high 7.1 affects latest 0.5 wpNamedUsers
-
high 7.1 affects latest 1.2.0 replyMail
-
critical 9.9 Widget Logic
-
medium 4.1 Smush
-
medium 4.3 Strong Testimonials
-
medium 4.3 Better Find and Replace
-
medium 6.1 Hubbub Lite
-
medium 4.3 Blog2Social
-
medium 4.3 Blog2Social
-
medium 5.3 Easy Digital Downloads
Security issue
-
medium 4.3 Easy Email Subscription
-
medium 4.9 Easy Email Subscription
Wednesday, November 5, 2025 · 22
-
medium 6.4 Ad Inserter
-
medium 5.3 The Events Calendar
-
medium 4.3 FunnelKit Automations
-
medium 5.3 FunnelKit Automations
-
medium 6.4 Graphina
-
medium 6.4 Visual Link Preview
-
medium 5.3 KiotViet Sync
-
medium 5.3 KiotViet Sync
Security issue
-
medium 4.3 KiotViet Sync
-
critical 9.8 KiotViet Sync
-
medium 6.4 Carousel Block
-
high 7.5 File Manager for Google Drive
-
medium 6.4 WPeMatico RSS Feed Fetcher
-
medium 4.3 Depicter
-
critical 9.8 AI Engine
-
medium 5.3 ElementInvader Addons for Elementor
-
high 7.5 The Events Calendar
-
medium 6.4 Spectra Legacy
-
medium 6.1 SMS for WordPress
-
medium 5.3 Paid Membership Subscriptions
-
medium 4.3 Features
Tuesday, November 4, 2025 · 32
-
critical 9.8 Easy Upload Files During Checkout
-
critical 9.8 ShopLentor
-
medium 6.4 Orbit Fox
-
medium 6.1 Centangle-Team
-
medium 6.1 Visit Counter
-
medium 6.1 MapMap
-
medium 6.1 Pagerank tools
-
medium 6.1 Top Bar Notification
-
medium 5.4 WPCF7 Stop words
-
medium 6.1 Associados Amazon Plugin
-
medium 6.1 LinkedIn Resume
-
medium 6.1 LMB^Box Smileys
-
medium 6.1 SH Contextual Help
-
medium 5.3 DominoKit
-
medium 6.4 Extensions for Leaflet Map
-
medium 4.4 Free Quotation
-
medium 4.3 Import Export For WooCommerce
-
medium 4.4 Nari Accountant
-
critical 9.8 Simple User Capabilities
-
medium 5.3 Simple User Capabilities
-
medium 4.4 WP Carticon
-
medium 6.4 Reuse Builder
-
medium 6.5 All in One Time Clock Lite
-
high 7.2 Footnotes Made Easy
-
high 8.8 EM Beer Manager
-
high 7.5 Elegance Menu
-
medium 6.4 Greenshift
-
medium 6.4 TablePress
Ran a vulnerable version? Check your site for signs of a hack
The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.
Browse vulnerabilities
Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution
Where this data comes from
- Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Plugin versions, update dates and install counts: the wordpress.org Plugins API.
- These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.