WordPress plugin vulnerabilities: week 50, 2025
311 vulnerabilities published Dec 8 – Dec 14, 2025 in 292 plugins we track, by day.
5 critical 32 high 271 medium 3 low
Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.
“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.
Sunday, December 14, 2025 · 2
-
high 7.5 wpForo Forum
Saturday, December 13, 2025 · 55
-
medium 6.4 a3 Lazy Load
-
medium 6.4 Popup Builder
-
medium 6.4 Redux Framework
-
medium 6.4 Enter Addons
-
medium 6.4 Livemesh SiteOrigin Widgets
-
medium 5.3 TI WooCommerce Wishlist
-
medium 6.4 WidgetKit for Elementor
-
medium 6.4 YITH WooCommerce Quick View
-
medium 6.4 JetWidgets For Elementor
-
medium 6.4 King Addons for Elementor
-
medium 6.4 Marquee Addons for Elementor
-
medium 4.3 HAPPY
-
medium 5.4 Shortcode Ajax
-
medium 4.3 Userback
-
medium 4.9 404 Solution
-
high 8.8 Doubly
-
medium 4.3 Lucky Draw Contests
-
medium 6.5 MediaCommander
-
medium 4.7 Solutions Ad Manager
-
medium 4.3 AnnunciFunebri
-
medium 5.4 Easy Notify Lite
-
critical 9.8 JAY Login & Register
-
medium 4.3 Popover Windows
-
medium 4.3 Popover Windows
-
high 8.8 Postem Ipsum
-
medium 5.3 Easy Theme Options
-
medium 5.3 Eyewear prescription form
-
medium 5.3 Eyewear prescription form
-
medium 6.4 HT Slider For Elementor
-
medium 4.4 Quick Testimonials
-
medium 4.3 SimpLy Gallery
-
medium 6.4 Custom Frames
-
medium 4.4 Custom Post Type UI
-
medium 4.9 Design Import/Export
-
medium 5.3 Devs CRM
-
medium 4.3 Employee Spotlight
-
high 8.8 WP3D Model Import Viewer
-
medium 5.3 Devs CRM
-
medium 4.3 GenerateBlocks
-
medium 6.4 Header Footer Script Adder
-
medium 6.1 WP to LinkedIn Auto Publish
-
high 7.5 WP Directory Kit
-
medium 6.4 Colibri Page Builder
-
medium 4.4 Emplibot
-
critical 9.8 Export WordPress Pages to Static HTML & PDF
-
medium 5.3 Login Lockdown & Protection
Weak randomness
-
medium 6.1 Social Media Auto Publish
-
medium 6.5 Brizy
-
critical 9.8 URL Shortener Plugin For WordPress
-
medium 5.9 YMC Filter
Friday, December 12, 2025 · 88
-
medium 4.3 Simple Bike Rental
-
medium 6.4 AI Feeds
-
medium 5.3 Events Manager
-
medium 6.4 Magical Posts Display
-
medium 4.3 Events Manager
-
medium 5.3 Bookit
Security issue
-
medium 5.5 MailerLite
-
medium 6.5 Simple CSV Table
-
medium 5.5 BSK PDF Manager
-
high 7.5 FunnelKit
-
medium 6.4 Mailgun Subscriptions
-
medium 6.5 Modula Image Gallery
-
medium 5.3 Guest Support
-
medium 5.3 Hippoo Mobile App for WooCommerce
-
medium 4.3 Ultra Addons for Contact Form 7
-
high 7.5 WPNakama
-
medium 4.3 Simple Theme Changer
-
medium 4.4 WP Job Portal
-
medium 6.4 Wpik WordPress Basic Ajax Form
-
medium 4.3 Resource Library for Logged In Users
-
critical 9.8 Multi Uploader for Gravity Forms
-
medium 4.3 Kirim.Email WooCommerce Integration
-
medium 4.3 Simple Theme Changer
-
medium 4.3 Vimeo SimpleGallery
-
medium 5.3 WPMasterToolKit (WPMTK)
-
medium 6.4 Ayo Shortcodes
-
medium 4.3 BMLT WordPress Satellite
-
medium 4.3 Coding Blocks
-
medium 4.3 Truefy Embed
-
medium 4.3 Upcoming for Calendly
-
medium 6.1 WPLG Default Mail From
-
medium 5.4 BuddyTask
-
medium 6.1 Category Dropdown List
-
medium 6.1 Like DisLike Voting
-
medium 6.1 Complag
-
medium 6.1 Simple AL Slider
-
medium 4.3 Animated Pixel Marquee Creator
-
medium 6.4 Bold Timeline Lite
-
medium 4.4 DebateMaster
-
high 8.1 Visitor Logic Lite
-
medium 4.4 SimplyConvert
-
medium 4.3 URL Media Uploader
-
medium 6.1 评论小秘书
-
medium 4.4 Contact Form 7 with ChatWork
-
medium 4.3 Purchase and Expense Manager
-
medium 4.4 TWW Protein Calculator
-
medium 4.9 WatchTowerHQ
-
medium 6.4 WP Dropzone
-
medium 6.4 Data Visualizer
-
medium 6.4 Divelogs Widget
-
medium 6.4 FX Currency Converter
-
medium 6.4 Paypal Payment Shortcode
-
medium 6.4 Reviews Sorted
-
medium 6.4 Hide Email Address
-
medium 6.4 GPXpress
-
medium 6.4 Simple Nivo Slider
-
medium 6.4 WP Flot
-
medium 6.4 WPGancio
-
medium 6.4 Zenost Shortcodes
-
medium 6.4 Bukazu Search Widget
-
medium 6.4 Easy Map Creator
-
medium 6.4 Flow-Flow Social Streams
-
medium 6.4 LS Google Map Router
-
medium 6.4 NewStatPress
-
medium 6.4 VigLink SpotLight By ShortCode
-
high 8.1 Blaze Demo Importer
-
medium 4.3 Foxtool All-in-One
-
medium 4.3 IMAQ CORE
-
medium 5.3 Premmerce Wishlist for WooCommerce
-
medium 4.3 Rabbit Hole
-
medium 6.8 WP User Manager
-
medium 6.1 Accept Stripe Payments Using Contact Form 7
-
medium 6.4 Better Addons for Elementor
-
medium 5.3 Campay Woocommerce Payment Gateway
-
medium 5.3 Filter Plus
-
high 8.8 Infility Global
-
critical 9.8 LazyTasks
-
high 8.8 Player Leaderboard
-
medium 4.3 Premmerce Brands for WooCommerce
-
medium 6.4 Simple post listing
-
medium 6.4 LJUsers
-
high 7.5 LT Unleashed
Thursday, December 11, 2025 · 4
-
medium 6.5 WP Job Portal
-
medium 6.4 Widgets for Google Reviews
-
medium 6.5 List category posts
-
medium 5.8 RSS Aggregator by Feedzy
Wednesday, December 10, 2025 · 5
-
high 8.8 Video Merchant
-
high 7.1 HandL UTM Grabber / Tracker
-
high 7.1 HandL UTM Grabber / Tracker
-
high 7.5 Hippoo Mobile App for WooCommerce
-
medium 4.9 Simple Download Counter
Tuesday, December 9, 2025 · 157
-
medium 5.4 Spectra Legacy
-
medium 4.3 WP Fast Cache
-
high 8.8 ARMember
-
medium 5.3 Slider a SlidersPack
-
medium 4.3 WebToffee eCommerce Marketing Automation
-
medium 4.3 Fluent Booking
-
medium 4.3 SupportCandy
-
medium 4.3 Business Directory Plugin
-
medium 4.3 My Calendar
-
medium 4.3 Quiz Maker by AYS
-
medium 4.3 Thim Kit for Elementor
-
medium 4.3 Ultimate FAQ Accordion Plugin
-
medium 4.3 UsersWP
-
medium 4.3 Elementor Website Builder
-
medium 4.7 Flexmls® IDX Plugin
-
medium 4.7 WP Gravity Forms FreshDesk Plugin
-
medium 5.3 GoDAM
-
medium 4.7 Highlight and Share
-
medium 5.3 IDonate
-
medium 4.3 PDF Invoices & Packing Slips for WooCommerce
-
medium 5.3 Constant Contact + WooCommerce
-
medium 5.3 Easy Form Builder by WhiteStudio
-
medium 5.3 Wbcom Designs
-
medium 5.3 TrueBooker
-
medium 5.3 Email Marketing Plugin
-
medium 5.3 Booking calendar, Appointment Booking System
-
medium 5.3 Simple Link Directory
-
medium 5.3 Sitewide Notice WP
-
medium 5.3 WPFunnels
-
medium 5.3 GSheetConnector
-
medium 5.4 Debug Log Viewer
-
medium 5.9 WP eBay Product Feeds
-
medium 5.4 Listdom
-
medium 5.3 Post SMTP
-
medium 5.9 Rencontre
-
medium 5.3 Pixel Manager for WooCommerce
-
medium 5.9 Advanced FAQ Manager
-
medium 6.5 Advanced FAQ Manager
-
medium 5.9 UseStrict’s Calendly Embedder
-
medium 5.9 Cookie Compliance for WordPress
-
medium 6.5 Walker Core
-
medium 6.5 WP Delicious
-
medium 6.5 Donation Thermometer
-
medium 6.5 FireBox
-
medium 6.5 oik
-
medium 6.5 Shopkeeper Extender
-
medium 6.5 Animation Addons
-
medium 6.5 Essential Widgets
-
medium 6.5 Multi-Step Checkout for WooCommerce
-
medium 6.5 WP-ShowHide
-
medium 6.5 LearnPress
-
high 7.1 Rencontre
-
high 7.1 Themify Portfolio Post
-
medium 6.5 ThirstyAffiliates
-
medium 6.6 WP Maps
-
high 7.6 Media Library Tools
-
high 7.6 Ninja Tables
-
high 8.5 Agile Store Locator
-
high 8.5 ArtPlacer Widget
-
medium 4.3 CWW Companion
-
medium 4.3 ForumWP
-
medium 4.3 PDF Thumbnail Generator
-
medium 4.3 Portfolio and Projects
-
medium 4.3 Quick Contact Form
-
medium 5.4 GiveWP
-
medium 4.3 Simple Link Directory
-
medium 4.3 Trinity Audio
-
medium 4.3 Chartify
-
medium 6.5 GiveWP
-
medium 4.3 Salon Booking System
-
medium 4.3 Easy Appointment Booking & Scheduling Plugin
-
medium 4.3 Elastic Email Sender
-
medium 4.3 Tablesome Table
-
medium 4.3 HappyAddons for Elementor
-
medium 4.3 My Tickets
-
low 2.7 Photo Block
-
medium 4.3 Simple Folio
-
medium 6.5 Cornerstone
-
medium 5.3 Ivory Search
-
medium 5.3 DTX
-
medium 4.3 Download Manager
-
medium 5.3 Media Library Assistant
-
medium 4.3 Custom Field Template
-
medium 6.5 WP Ultimate Review
-
medium 5.3 Yandex.Metrica
-
medium 4.3 Contact Form by BestWebSoft
-
medium 6.5 Master Addons for Elementor
-
medium 5.3 Quiz and Survey Master (QSM)
-
medium 6.5 SimpLy Gallery
-
medium 6.5 Tutor LMS Elementor Addons
-
medium 6.5 Xpro Addons
-
high 7.1 New User Approve
-
medium 5.4 Page View Count
-
medium 4.3 Xagio SEO & AEO
-
medium 5.4 Order Delivery Date for WooCommerce
-
medium 5.3 Payment Gateway for PayPal on WooCommerce
-
medium 5.3 ERP
-
medium 4.3 Paysera Payment Gateway for WooCommerce
-
medium 5.3 affects latest 2.8.2 WP Google Analytics Events
-
medium 4.3 WP Hotel Booking
-
medium 4.3 WP Hotel Booking
-
medium 5.9 WP Hotel Booking
-
medium 4.3 Custom Layouts
-
medium 4.3 EventPrime
-
medium 4.3 EventPrime
-
medium 5.3 WP EasyCart
-
medium 4.3 WP AI CoPilot
-
medium 5.3 Eupago Gateway For Woocommerce
-
medium 4.3 Social Photo Fetcher
-
medium 4.3 affects latest 1.2.1 Just TinyMCE Custom Styles
-
medium 4.3 MultiParcels Shipping For WooCommerce
-
medium 4.3 Notification for Telegram
-
medium 4.3 WP Flashy Marketing Automation
-
medium 4.3 Auto Alt Text
-
medium 4.3 Ergonet Cache
-
medium 4.3 Gravitec.net
-
medium 5.3 affects latest 1.0.0 Post Cloner
-
medium 4.3 SMTP Mail
-
medium 6.5 Add Custom Codes
-
medium 5.3 affects latest 2.0.2 Formstack Online Forms
-
medium 5.3 affects latest 1.9.2 Image Cleanup
-
medium 4.3 affects latest 1.9.2 Image Cleanup
-
medium 4.3 Media Library Downloader
-
medium 5.3 affects latest 1.1 User Spam Remover
-
medium 5.3 WP-CRM System
-
medium 5.3 Geo Controller
-
medium 5.3 ConveyThis AI Multilingual Translation
-
medium 4.3 Custom Sidebars by ProteusThemes
-
medium 4.3 DoFollow Case by Case
-
medium 4.3 Media Library File Download
-
medium 5.3 Quick Interest Slider
-
medium 5.4 affects latest 2.34 Яндекс Доставка (Boxberry)
-
medium 6.5 Generic Elements
-
medium 6.5 Gutenverse News
-
medium 5.3 affects latest 1.1.9 ThemeRain Core
-
medium 4.3 affects latest 1.0 Duplicate Content Cure
-
medium 4.3 Actionwear products sync
-
high 7.1 affects latest 1.3.1 Create Posts & Terms
-
high 7.1 affects latest 1.2 PDF Creator Lite
-
medium 5.3 affects latest 1.0.5 Hype
-
high 7.1 affects latest 0.6.8.1 WP sIFR
-
medium 5.4 ProfilePress
-
medium 4.3 Beaver Builder Page Builder
-
medium 5.9 WPeMatico RSS Feed Fetcher
Ran a vulnerable version? Check your site for signs of a hack
The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.
Browse vulnerabilities
Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution
Where this data comes from
- Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Plugin versions, update dates and install counts: the wordpress.org Plugins API.
- These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.