WordPress plugin vulnerabilities: week 49, 2025

118 vulnerabilities published Dec 1 – Dec 7, 2025 in 108 plugins we track, by day.

6 critical 22 high 89 medium 1 low

Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.

“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.

Saturday, December 6, 2025 · 33

• high 8.8 Starter Templates

  Arbitrary file upload

  CVE-2025-13065 · affected 4.4.41 and older · fixed in 4.4.42 *

• high 8.8 All-in-One Video Gallery

  Arbitrary file upload

  CVE-2025-12966 · affected 4.5.4 to 4.5.7 · fixed in 4.6.4 *

• high 7.2 Rich Showcase for Google Reviews

  Stored cross-site scripting (XSS)

  CVE-2025-12499 · affected 6.8 and older · fixed in 6.8.1 *

• medium 5.3 Fluent Forms

  Missing authorization check

  CVE-2025-13748 · affected 6.1.7 and older · fixed in 6.1.8 *

• high 8.1 10Web Booster

  Denial of service

  CVE-2025-13377 · affected 2.32.7 and older · fixed in 2.32.11 *

• medium 6.4 CSS3 Buttons

  Stored cross-site scripting (XSS)

  CVE-2025-13907 · affected 0.1 and older · fix not stated

• medium 6.4 Social Feed Gallery Portfolio

  Stored cross-site scripting (XSS)

  CVE-2025-13896 · affected 1.3 and older · fix not stated

• medium 6.4 TR Timthumb

  Stored cross-site scripting (XSS)

  CVE-2025-13899 · affected 1.0.4 and older · fix not stated

• medium 6.4 Ultra Skype Button

  Stored cross-site scripting (XSS)

  CVE-2025-13898 · affected 1.0 and older · fix not stated

• medium 6.1 CSV Sumotto

  Reflected cross-site scripting (XSS)

  CVE-2025-13894 · affected 1.0 and older · fix not stated

• medium 6.4 Cute News Ticker

  Stored cross-site scripting (XSS)

  CVE-2025-13656 · affected 1.0 and older · fix not stated

• medium 6.4 Extra Post Images

  Stored cross-site scripting (XSS)

  CVE-2025-13856 · affected 1.0 and older · fix not stated

• medium 5.3 Plug your WooCommerce into the largest catalog…

  Missing authorization check

  CVE-2025-13666 · affected 2.1.2 and older · fix not stated

• medium 6.4 RevInsite

  Stored cross-site scripting (XSS)

  CVE-2025-13863 · affected 1.1.0 and older · fix not stated

• medium 6.4 Yet Another WebClap for WordPress

  Stored cross-site scripting (XSS)

  CVE-2025-13857 · affected 0.2 and older · fix not stated

• medium 5.4 Application Passwords

  Reflected cross-site scripting (XSS)

  CVE-2025-13308 · affected 0.1.3 and older · fix not stated

• medium 5.3 Accessiy by CodeConfig

  Missing authorization check

  CVE-2025-13358 · affected 1.0.0 and older · fix not stated

• medium 4.3 Accessiy by CodeConfig

  Missing authorization check

  CVE-2025-13309 · affected 1.0.2 and older · fix not stated

• medium 6.1 myLCO

  Reflected cross-site scripting (XSS)

  CVE-2025-13626 · affected 0.8.1 and older · fix not stated

• medium 6.1 Live Sales Notification for Woocommerce

  Reflected cross-site scripting (XSS)

  CVE-2025-13137 · affected 3.6.3 and older · fix not stated

• medium 4.3 WP Landing Page

  Cross-site request forgery (CSRF)

  CVE-2025-13629 · affected 0.9.3 and older · fix not stated

• medium 6.4 Canadian Nutrition Facts Label

  Stored cross-site scripting (XSS)

  CVE-2025-12715 · affected 3.0 and older · fix not stated

• critical 9.8 Flex QR Code Generator

  Arbitrary file upload

  CVE-2025-12673 · affected 1.2.7 and older · fixed in 1.2.8 *

• medium 5.3 g-FFL Cockpit

  Information disclosure

  CVE-2025-12721 · affected 1.7.1 and older · fixed in 1.8.0 *

• medium 5.3 g-FFL Cockpit

  Missing authorization check

  CVE-2025-12720 · affected 1.7.1 and older · fixed in 1.8.0 *

• medium 6.4 List Attachments Shortcode

  Stored cross-site scripting (XSS)

  CVE-2025-12717 · affected 0.4.1a and older · fix not stated

• medium 4.3 Listar

  Missing authorization check

  CVE-2025-12577 · affected 3.0.0 and older · fix not stated

• medium 4.3 Listar

  Missing authorization check

  CVE-2025-12574 · affected 3.0.0 and older · fix not stated

• medium 4.3 Search, Filters & Merchandising for WooCommerce

  Missing authorization check

  CVE-2025-12091 · affected 3.0.67 and older · fixed in 3.0.68 *

• medium 6.5 PublishPress Taxonomies

  SQL injection

  CVE-2025-13922 · affected 3.40.1 and older · fixed in 3.41.0 *

• medium 5.4 weDocs

  Missing authorization check

  CVE-2025-12505 · affected 2.1.14 and older · fixed in 2.1.15 *

• high 7.2 Widgets for Google Reviews

  Stored cross-site scripting (XSS)

  CVE-2025-12510 · affected 13.2.4 and older · fixed in 13.2.9 *

• medium 6.1 Link Whisper Free

  Reflected cross-site scripting (XSS)

  CVE-2025-11263 · affected 0.8.8 and older · fixed in 0.8.9 *

Friday, December 5, 2025 · 50

• medium 5.3 Wp Social Login and Register Social Counter

  Missing authorization check

  CVE-2025-13620 · affected 3.1.3 and older · fixed in 3.1.4 *

• medium 6.4 CryptX

  Stored cross-site scripting (XSS)

  CVE-2025-13739 · affected 4.0.5 and older · fixed in 4.0.6 *

• medium 6.4 Thai Lottery Widget

  Stored cross-site scripting (XSS)

  CVE-2025-13678 · affected 2.5 and older · fixed in 2.6 *

• medium 4.4 Trail Manager

  Stored cross-site scripting (XSS)

  CVE-2025-13682 · affected 1.0.0 and older · fix not stated

• high 8.1 Cool Tag Cloud

  Stored cross-site scripting (XSS)

  CVE-2025-13614 · affected 2.29 and older · fix not stated

• medium 5.3 Projectopia

  Missing authorization check

  CVE-2025-12876 · affected 5.1.19 and older · fixed in 5.1.20 *

• high 8.8 User Generator and Importer

  Cross-site request forgery (CSRF)

  CVE-2025-12879 · affected 1.2.2 and older · fix not stated

• high 8.1 My auctions allegro

  File inclusion

  CVE-2025-12851 · affected 3.6.32 and older · fixed in 3.6.33 *

• medium 4.3 ARK Related Posts

  Cross-site request forgery (CSRF)

  CVE-2025-13684 · affected 2.19 and older · fixed in 2.20 *

• medium 4.3 WC Vendors

  Cross-site request forgery (CSRF)

  CVE-2025-12130 · affected 2.6.4 and older · fixed in 2.6.4.1 *

• high 7.5 My auctions allegro

  SQL injection

  CVE-2025-12850 · affected 3.6.32 and older · fixed in 3.6.33 *

• medium 6.1 Nouri.sh Newsletter

  Reflected cross-site scripting (XSS)

  CVE-2025-13515 · affected 1.0.1.3 and older · fix not stated

• critical 9.8 User Verification by PickPlugins

  Authentication bypass

  CVE-2025-12374 · affected 2.0.44 and older · fix not stated

• medium 4.3 Live CSS Preview

  Missing authorization check

  CVE-2025-12354 · affected 2.1.4 and older · fixed in 2.1.5 *

• medium 5.3 Payaza

  Missing authorization check

  CVE-2025-12355 · affected 0.3.8 and older · fixed in 0.3.10 *

• medium 4.3 Torod

  Cross-site request forgery (CSRF)

  CVE-2025-12373 · affected 1.9 and older · fixed in 2.0 *

• medium 4.4 Weekly Planner

  Stored cross-site scripting (XSS)

  CVE-2025-12186 · affected 1.0 and older · fix not stated

• medium 5.3 Voidek Employee Portal

  Missing authorization check

  CVE-2025-12093 · affected 1.0.7 and older · fixed in 1.0.8 *

• medium 6.1 dream gallery

  Cross-site request forgery (CSRF)

  CVE-2025-13621 · affected 1.0 and older · fix not stated

• medium 6.4 Easy Jump Links Menus

  Stored cross-site scripting (XSS)

  CVE-2025-13860 · affected 1.0.0 and older · fix not stated

• medium 6.1 Jabbernotification

  Reflected cross-site scripting (XSS)

  CVE-2025-13622 · affected 0.99-RC2 and older · fix not stated

• medium 6.1 Twitscription

  Reflected cross-site scripting (XSS)

  CVE-2025-13623 · affected 0.1.1 and older · fix not stated

• medium 6.1 WP-SOS-Donate Donation Sidebar Plugin

  Reflected cross-site scripting (XSS)

  CVE-2025-13625 · affected 0.9.2 and older · fix not stated

• medium 4.3 ContentStudio

  Cross-site request forgery (CSRF)

  CVE-2025-13144 · affected 1.3.7 and older · fixed in 1.4.0 *

• medium 6.1 CoSign Single Signon

  Reflected cross-site scripting (XSS)

  CVE-2025-13512 · affected 0.3.1 and older · fix not stated

• medium 5.3 Feedback Modal for Website

  Missing authorization check

  CVE-2025-13528 · affected 1.0.1 and older · fix not stated

• medium 4.3 Takeads

  Missing authorization check

  CVE-2025-12370 · affected 1.0.13 and older · fix not stated

• medium 6.4 Sermon Manager

  Stored cross-site scripting (XSS)

  CVE-2025-12368 · affected 2.30.0 and older · fix not stated

• medium 4.3 Quantic Social Image Hover

  Cross-site request forgery (CSRF)

  CVE-2025-13360 · affected 1.0.8 and older · fix not stated

• high 8.8 Bread & Butter

  Cross-site request forgery (CSRF)

  CVE-2025-12189 · affected 7.11.1374 and older · fix not stated

• high 8.8 ContentStudio

  Arbitrary file upload

  CVE-2025-12181 · affected 1.3.7 and older · fixed in 1.4.0 *

• medium 4.3 Image Optimizer by wps.sk

  Cross-site request forgery (CSRF)

  CVE-2025-12190 · affected 1.2.0 and older · fix not stated

• medium 6.4 Omnipress

  Stored cross-site scripting (XSS)

  CVE-2025-12163 · affected 1.6.5 and older · fixed in 1.6.6 *

• medium 5.4 PDF Catalog for WooCommerce

  Stored cross-site scripting (XSS)

  CVE-2025-12191 · affected 1.1.18 and older · fix not stated

• medium 4.3 Webcake

  Missing authorization check

  CVE-2025-12165 · affected 1.1 and older · fixed in 1.2 *

• high 8.8 Auto Thumbnailer

  Arbitrary file upload

  CVE-2025-12154 · affected 1.0 and older · fix not stated

• medium 4.3 EPROLO-Dropshipping

  Missing authorization check

  CVE-2025-12133 · affected 2.3.1 and older · fix not stated

• high 8.8 Featured Image via URL

  Arbitrary file upload

  CVE-2025-12153 · affected 0.1 and older · fix not stated

• medium 4.4 FitVids for WordPress

  Stored cross-site scripting (XSS)

  CVE-2025-12124 · affected 4.0.1 and older · fix not stated

• medium 4.3 Hide Categories Or Products On Shop Page

  Cross-site request forgery (CSRF)

  CVE-2025-12128 · affected 1.0.7 and older · fix not stated

• medium 4.3 Time Sheets

  Cross-site request forgery (CSRF)

  CVE-2025-10055 · affected 2.1.3 and older · fix not stated

• medium 4.3 Norby AI

  Cross-site request forgery (CSRF)

  CVE-2025-13362 · affected 1.0.3 and older · fix not stated

• medium 5.3 SSP Debug

  Information disclosure

  CVE-2025-13494 · affected 1.0.0 and older · fix not stated

• critical 9.8 CRM Memberships

  Privilege escalation

  CVE-2025-13313 · affected 2.6 and older · fixed in 2.7 *

• medium 5.3 CRM Memberships

  Missing authorization check

  CVE-2025-13312 · affected 2.5 and older · fixed in 2.6 *

• medium 5.3 SurveyFunnel

  Information disclosure

  CVE-2025-13006 · affected 1.1.5 and older · fix not stated

• medium 6.4 SurveyFunnel

  Stored cross-site scripting (XSS)

  CVE-2025-12417 · affected 1.1.5 and older · fix not stated

• high 8.8 Demo Importer Plus

  Arbitrary file upload

  CVE-2025-13066 · affected 2.0.6 and older · fixed in 2.0.7 *

• medium 6.4 Booking Calendar

  Stored cross-site scripting (XSS)

  CVE-2025-12804 · affected 10.14.6 and older · fixed in 10.14.7 *

• medium 4.3 Backup, Restore and Migrate your sites with XC…

  Cross-site request forgery (CSRF)

  CVE-2025-11759 · affected 4.8.2 and older · fixed in 4.8.3 *

Thursday, December 4, 2025 · 6

• high 8.8 PostGallery

  Arbitrary file upload

  CVE-2025-13543 · affected 1.12.5 and older · fix not stated

• medium 4.8 Custom Post Type UI

  Missing authorization check

  CVE-2025-12826 · affected 1.18.0 and older · fixed in 1.18.1 *

• medium 4.3 Beaver Builder Page Builder

  Missing authorization check

  CVE-2025-12782 · affected 2.9.4 and older · fixed in 2.9.4.1 *

• medium 6.1 Clik stats

  Reflected cross-site scripting (XSS)

  CVE-2025-13513 · affected 0.8 and older · fix not stated

• high 7.2 Omnichannel for WooCommerce

  Stored cross-site scripting (XSS)

  CVE-2025-11727 · affected 1.3.65 and older · fix not stated

• medium 5.3 WebP Express

  Information disclosure

  CVE-2025-11379 · affected 0.25.9 and older · fixed in 0.25.10 *

Wednesday, December 3, 2025 · 14

• medium 6.4 Autoptimize

  Stored cross-site scripting (XSS)

  CVE-2025-13401 · affected 3.1.13 and older · fixed in 3.1.14 *

• medium 4.3 Fluent Booking

  Missing authorization check

  CVE-2025-13756 · affected 1.9.11 and older · fixed in 1.10.0 *

• critical 9.8 WP Directory Kit

  Authentication bypass

  CVE-2025-13390 · affected 1.4.0 to 1.4.4 · fixed in 1.4.5 *

• critical 9.8 ACF Frontend Admin by DynamiApps

  Missing authorization check

  CVE-2025-13342 · affected 3.28.20 and older · fixed in 3.28.21 *

• medium 5.4 Post SMTP

  Missing authorization check

  CVE-2025-12887 · affected 3.6.1 and older · fixed in 3.6.2 *

• medium 4.3 ShopEngine

  Cross-site request forgery (CSRF)

  CVE-2025-12358 · affected 4.8.5 and older · fixed in 4.8.6 *

• critical 9.8 Advanced Custom Fields

  Remote code execution

  CVE-2025-13486 · affected 0.9.0.5 to 0.9.1.1 · fixed in 0.9.2 *

• low 2.7 Timetable and Event Schedule by MotoPress

  Missing authorization check

  CVE-2025-12954 · affected older than 2.4.16 · fixed in 2.4.16

• medium 4.9 FluentCart

  SQL injection

  CVE-2025-13495 · affected 1.3.1 and older · fixed in 1.3.2 *

• medium 5.3 MxChat

  Information disclosure

  CVE-2025-12585 · affected 2.5.5 and older · fixed in 2.5.6 *

• medium 5.3 Everest Backup

  Missing authorization check

  CVE-2025-10304 · affected 2.3.8 and older · fixed in 2.3.9 *

• medium 6.6 Modula Image Gallery

  Arbitrary file upload

  CVE-2025-13646 · affected 2.13.1 to 2.13.2 · fixed in 2.13.3 *

• high 7.2 Modula Image Gallery

  Arbitrary file deletion

  CVE-2025-13645 · affected 2.13.1 to 2.13.2 · fixed in 2.13.3 *

• medium 6.4 CSSIgniter Shortcodes

  Stored cross-site scripting (XSS)

  CVE-2025-13448 · affected 2.4.1 and older · fixed in 2.4.2 *

Tuesday, December 2, 2025 · 14

• medium 6.4 Nexter Extension

  Stored cross-site scripting (XSS)

  CVE-2025-13731 · affected 4.4.1 and older · fixed in 4.4.2 *

• medium 4.9 WP Directory Kit

  SQL injection

  CVE-2025-13090 · affected 1.4.6 and older · fixed in 1.4.7 *

• high 8.8 ELEX WordPress HelpDesk & Customer Ticketing S…

  Privilege escalation

  CVE-2025-13534 · affected 3.3.2 and older · fixed in 3.3.3 *

• high 8.1 SureMail

  Arbitrary file upload

  CVE-2025-13516 · affected 1.9.0 and older · fixed in 1.9.1 *

• high 7.5 VikRentCar Car Rental Management System

  SQL injection

  CVE-2025-13724 · affected 1.4.4 and older · fixed in 1.4.5 *

• medium 5.3 Zigaform

  Information disclosure

  CVE-2025-13696 · affected 7.6.5 and older · fix not stated

• medium 4.3 Beaver Builder Page Builder

  Missing authorization check

  CVE-2025-11726 · affected 2.9.4 and older · fixed in 2.9.4.1 *

• medium 4.3 Photo Gallery by Ays

  Cross-site request forgery (CSRF)

  CVE-2025-13685 · affected 6.4.8 and older · fixed in 6.4.9 *

• medium 4.3 SurveyJS

  Cross-site request forgery (CSRF)

  CVE-2025-13140 · affected 1.12.20 and older · fixed in 2.5.2 *

• medium 6.1 WP Social Ninja

  Stored cross-site scripting (XSS)

  CVE-2025-13007 · affected 3.20.3 and older · fixed in 4.0.0 *

• medium 6.5 Visualizer

  SQL injection

  CVE-2025-12483 · affected 3.11.12 and older · fixed in 3.11.13 *

• high 7.2 Kadence WooCommerce Email Designer

  Stored cross-site scripting (XSS)

  CVE-2025-13387 · affected 1.5.17 and older · fixed in 1.5.18 *

• medium 6.4 BlockArt Blocks

  Stored cross-site scripting (XSS)

  CVE-2025-13697 · affected 2.2.13 and older · fixed in 2.2.14 *

• high 8.8 Cost Calculator Builder

  Arbitrary file deletion

  CVE-2025-12529 · affected 3.6.3 and older · fixed in 3.6.4 *

Monday, December 1, 2025 · 1

• medium 6.5 Arconix Shortcodes

  Stored cross-site scripting (XSS)

  CVE-2025-13835 · affected 2.1.20 and older · fixed in 2.2.0 *

Ran a vulnerable version? Check your site for signs of a hack

The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.

Scan free

Browse vulnerabilities

• Published this week
• Unpatched in the latest version
• By type of vulnerability

Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution

Where this data comes from

• Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
• Plugin versions, update dates and install counts: the wordpress.org Plugins API.
• These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.

← Check a plugin · Free hacked-site scan