WordPress plugin vulnerabilities: week 46, 2025
119 vulnerabilities published Nov 10 – Nov 16, 2025 in 112 plugins we track, by day.
4 critical 14 high 101 medium
Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.
“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.
Sunday, November 16, 2025 · 1
Saturday, November 15, 2025 · 5
-
medium 5.3 Contest Gallery
-
medium 4.3 All in One SEO
-
medium 6.5 Project Manager
-
medium 4.3 Modula Image Gallery
-
medium 4.3 Qi Blocks
Friday, November 14, 2025 · 2
-
medium 4.9 School Management System
-
high 7.2 SNORDIAN's H5PxAPIkatchu
Thursday, November 13, 2025 · 37
-
medium 4.3 Envira Gallery
-
medium 6.5 Booking Calendar
-
medium 5.3 JetFormBuilder
-
medium 4.3 Order Export & Order Import for WooCommerce
-
medium 6.5 Qi Blocks
-
medium 6.5 Booster for WooCommerce
-
medium 5.3 WPBot
-
medium 6.5 Contact Form Email
-
medium 4.3 Booster for WooCommerce
-
medium 5.3 YOP Poll
-
medium 6.5 Booking Manager
-
medium 6.5 Survey Maker by AYS
-
medium 6.5 WP Plugin Manager
-
medium 4.3 WPKoi Templates for Elementor
-
medium 5.4 Appointment Booking Calendar
-
medium 6.5 Auto Prune Posts
-
medium 4.3 Frontend File Manager Plugin
-
medium 5.9 Popup addon for Ninja Forms
-
medium 5.3 Theater for WordPress
-
medium 5.4 Content Pilot
-
medium 4.3 Convert WebP & AVIF
-
medium 6.4 Save as PDF Button
-
medium 6.4 WordPress Content Flipper
-
medium 5.3 WP Headless CMS Framework
Security issue
-
high 7.1 AI Engine
-
medium 5.3 Simple Comment Editing
-
medium 4.9 Poll Maker by AYS
-
medium 5.3 Survey Maker by AYS
-
medium 5.3 SureForms
-
medium 5.3 Survey Maker by AYS
-
medium 5.3 Welcart e-Commerce
-
high 8.8 WP All Import
-
medium 6.5 Data Tables Generator by Supsystic
-
medium 4.3 Page Builder
-
high 8.8 LifterLMS
Wednesday, November 12, 2025 · 11
-
high 7.6 0 Day Analytics
-
high 7.2 Easy Email Subscription
-
medium 6.5 Specific Content For Mobile
-
medium 4.3 WP Ultimate CSV Importer
-
high 7.5 Bookit
-
medium 4.3 Alt Text Generator AI
-
medium 4.4 MembershipWorks
-
medium 4.3 Asgaros Forum
-
medium 4.3 GeoDirectory
-
medium 4.3 Wishlist and Save for later for Woocommerce
Tuesday, November 11, 2025 · 63
-
high 8.8 Blocksy Companion
-
medium 4.3 Classified Listing
-
medium 5.3 Hydra Booking
Security issue
-
medium 5.3 Hydra Booking
Weak randomness
-
critical 10.0 TNC Toolbox
-
medium 6.4 Chart Expert
-
medium 6.4 Geopost
-
critical 9.8 Holiday class post calendar
-
medium 5.4 progressmatify
-
medium 6.4 GitHub Gist Shortcode Plugin
-
medium 4.3 Ninja Countdown
-
medium 6.4 Share to Google Classroom
-
medium 6.4 WP Count Down Timer
-
medium 6.4 Flickr Show
-
medium 6.4 WP-Iconics
-
medium 6.4 Coon Google Maps
-
medium 6.4 Jeba Cute forkit
-
medium 6.4 Live Photos on WordPress
-
medium 6.4 Nonaki
-
medium 6.4 Preload Current Images
-
medium 6.4 Ungapped Widgets
-
high 8.8 Elastic Theme Editor
-
medium 5.5 RandomQuotr
-
medium 4.4 Squirrels Auto Inventory
-
medium 4.3 USB Qr Code Scanner For Woocommerce
-
medium 6.1 WP-Walla
-
medium 6.1 YSlider
-
medium 4.4 Fleet Manager
-
medium 4.3 Private Google Calendars
-
medium 5.4 The Total Book Project
-
medium 4.3 WP Custom Admin Login Page Logo
-
medium 6.1 WP-OAuth
-
medium 5.3 Multi Location Marker
-
medium 6.5 Authors List
-
medium 5.3 Document Pro Elementor
-
medium 4.9 Double the Donation
-
medium 5.5 Featured Image
-
medium 5.3 Find Unused Images
-
medium 5.3 Crypto
-
medium 5.3 Crypto
-
medium 4.3 CTL Arcade Lite
-
medium 6.4 Simple Donate
-
medium 6.4 My Geo Posts Free
-
medium 6.4 Twitter Feed
-
medium 6.4 Paypal Donation Shortcode
-
medium 6.4 Precise Columns
-
medium 5.4 Slippy Slider
-
medium 6.4 WP BBCode
-
medium 6.4 Post Blocks & Tools
-
medium 6.4 Eventbee Ticketing Widget
-
medium 6.4 Five9 Live Chat
-
medium 6.4 Skip to Timestamp
-
medium 6.4 Woocommerce
-
medium 6.4 WP Bootstrap Tabs
-
high 7.5 Auto Amazon Links
-
critical 9.8 WP移行専用プラグイン for CPI
-
critical 9.8 EasyCommerce
-
high 8.1 Astra Security Suite
-
high 8.8 Mementor Core
-
medium 5.3 Wisly
-
medium 6.4 Include Fussball.de Widgets
Ran a vulnerable version? Check your site for signs of a hack
The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.
Browse vulnerabilities
Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution
Where this data comes from
- Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Plugin versions, update dates and install counts: the wordpress.org Plugins API.
- These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.