WordPress plugin vulnerabilities: week 47, 2025
172 vulnerabilities published Nov 17 – Nov 23, 2025 in 150 plugins we track, by day.
2 critical 27 high 142 medium 1 low
Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.
“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.
Saturday, November 22, 2025 · 8
-
high 7.5 OneClick Chat to Order
-
medium 5.3 Booking Calendar Contact Form
-
medium 4.3 GSheetConnector
-
medium 5.3 Appointment Booking Calendar
-
high 7.5 CP Contact Form with PayPal
-
medium 5.3 IDonate
-
medium 5.3 Subscriptions & Memberships for PayPal
Security issue
-
medium 6.4 Cookie Compliance for WordPress
Friday, November 21, 2025 · 100
-
high 7.2 S2B AI Assistant
-
medium 5.3 Tainacan
-
medium 5.3 Better Chat Support for Messenger
-
medium 6.6 Easy Invoice
-
medium 4.3 Accessibility Tool Kit
-
medium 5.3 Feeds for TikTok
-
medium 6.5 Nelio Popups
-
medium 5.3 Subscriptions & Memberships for PayPal
-
medium 4.3 TNC Toolbox
-
medium 5.3 Cart Weight for WooCommerce
-
medium 4.3 CBX Bookmark & Favorite
-
medium 5.3 ChatHelp
-
medium 4.3 Featured Post Creative
-
medium 4.3 I Order Terms
-
medium 4.3 Tableberg
-
medium 6.5 Travelers' Map
-
medium 6.5 Accordion Slider
-
medium 6.5 Extensions for Leaflet Map
-
high 8.5 KiviCare
-
medium 6.5 SKT Skill Bar
-
medium 6.5 Stylish Cost Calculator
-
medium 4.3 WebToffee WooCommerce Product Feeds
-
medium 4.3 Arconix Shortcodes
-
medium 4.3 FluentCommunity
-
medium 5.3 Event Booking Manager for WooCommerce
-
medium 5.3 Event Booking Manager for WooCommerce
-
medium 4.3 Property Hive
-
medium 5.3 SMS Alert
-
medium 5.3 Custom Order Numbers for WooCommerce
-
medium 4.3 WPLP Cookie Consent
-
medium 6.5 Gutenverse Form
-
medium 5.9 Head Meta Data
-
medium 5.3 Legal Pages
-
medium 5.3 UsersWP
-
high 7.2 WP Webhooks
-
medium 6.5 Envo Extra
-
medium 6.5 FunnelKit
-
medium 6.5 Gutenverse
-
medium 4.3 Giveaways and Contests by RafflePress
-
medium 4.3 PPOM
-
medium 5.4 WP Google Review Slider
-
low 3.4 WP YouTube Lyte
-
medium 6.5 Bold Page Builder
-
medium 4.3 Seriously Simple Podcasting
-
medium 5.3 Seriously Simple Podcasting
-
medium 5.3 Seriously Simple Podcasting
-
medium 4.3 Uncanny Automator
-
medium 6.4 FluentCRM
-
medium 4.9 Groundhogg
-
medium 6.4 Magical Shop Builder
-
high 7.5 WP Directory Kit
-
high 7.2 MemberHero
-
medium 4.4 WP Delete Post Copies
-
medium 6.4 HT Mega Addons for Elementor
-
high 8.8 Vitepos
-
medium 6.4 WP Company Info
-
medium 6.4 Shortcode for Google Street View
-
medium 6.4 WPSite Shortcode
-
medium 4.3 Custom Post Type
-
high 7.1 Flo Forms
-
high 8.1 WP AUDIO GALLERY
-
medium 6.4 HotelRunner Booking Widget
-
medium 5.3 Import WP
-
medium 5.4 Return Refund and Exchange For WooCommerce
-
medium 5.3 morkva Checkbox Integration
-
medium 6.4 Pollcaster Shortcode Plugin
-
medium 6.1 Tainacan
-
medium 6.4 Padlet Shortcode
-
high 8.8 Realty Portal
-
high 8.8 URL Image Importer
-
medium 4.3 Return Refund and Exchange For WooCommerce
-
high 7.2 WPBookit
-
medium 6.4 AudioTube
-
medium 6.4 Bulma Shortcodes
-
medium 6.1 EchBay Admin Security
-
medium 6.4 Surbma
-
medium 4.3 UiPress lite
-
medium 6.4 Affiliate AI Lite
-
medium 6.4 BrightTALK WordPress Shortcode
-
medium 6.4 Islamic Phrases
-
medium 6.4 Shortcodes Bootstrap
-
medium 6.4 Stock Tools
-
medium 6.4 Tips Shortcode
-
medium 6.4 Display Pages Shortcode
-
critical 9.8 ELEX WordPress HelpDesk & Customer Ticketing S…
-
medium 6.5 UiPress lite
-
medium 6.4 UiPress lite
-
medium 5.3 LearnPress
Thursday, November 20, 2025 · 1
-
medium 5.3 MemberKits
Wednesday, November 19, 2025 · 22
-
medium 6.1 GiveWP
-
high 8.0 Code Snippets
-
medium 4.3 SiteSEO
-
medium 5.3 SureForms
-
medium 6.4 FunnelKit
-
medium 6.4 User Profile Builder
-
high 7.2 WP Ultimate CSV Importer
-
high 7.5 Community Events
-
medium 4.3 WP Login and Register using JWT
-
medium 5.3 SiteSEO
-
medium 6.4 Pet-Manager
-
medium 5.3 Time Slot
Security issue
-
medium 4.3 WSChat
-
medium 6.5 Directorist
-
medium 5.4 Responsive Lightbox & Gallery
-
high 7.5 Quiz Maker by AYS
-
medium 6.4 Royal Addons for Elementor
-
medium 5.3 YITH WooCommerce Wishlist
-
medium 5.3 New User Approve
-
medium 5.3 YITH WooCommerce Wishlist
Tuesday, November 18, 2025 · 39
-
medium 6.8 AI Engine
-
medium 6.4 Icon List Block
-
medium 5.3 Pixel Manager for WooCommerce
-
medium 5.8 WP Migrate Lite
-
medium 6.6 Simple User Import Export
CSV injection
-
medium 5.4 Element Pack Addons for Elementor
-
high 8.8 Enable SVG, WebP, and ICO Upload
-
medium 4.3 wModes
-
medium 5.3 Restrictions for BuddyPress
-
medium 6.4 Enable SVG, WebP, and ICO Upload
-
medium 6.4 Meta Display Block
-
medium 4.3 WP Duplicate Page
-
medium 6.1 WP Twitter Auto Publish
-
medium 5.4 Broken Link Checker by AIOSEO
-
medium 4.3 Coil Web Monetization
-
medium 6.4 Gutenify
-
medium 6.4 RTMKit for Elementor
-
high 8.8 Product Filter
-
medium 6.5 ACF Flexible Layouts Manager
-
medium 4.3 Download Panel (Biggiko Team)
-
medium 6.4 Local Syndication
-
medium 4.3 Top Friends
-
medium 6.1 Like-it
-
high 8.1 Pie Forms
-
medium 6.1 Project Honey Pot Spam Trap
-
high 8.8 WP Dropzone
-
medium 6.1 ArtiBot Free Chat Bot for WebSites
-
medium 6.4 everviz
-
high 7.2 Multiple Roles per User
-
medium 4.3 The Permalinks Cascade
-
medium 4.3 WP Admin Microblog
-
medium 6.4 VK All in One Expansion Unit
-
medium 6.4 VK All in One Expansion Unit
-
medium 5.4 Post Type Switcher
Monday, November 17, 2025 · 2
-
medium 5.4 Classified Listing
-
critical 9.0 W3 Total Cache
Ran a vulnerable version? Check your site for signs of a hack
The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.
Browse vulnerabilities
Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution
Where this data comes from
- Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Plugin versions, update dates and install counts: the wordpress.org Plugins API.
- These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.