WordPress plugin vulnerabilities: week 51, 2025
200 vulnerabilities published Dec 15 – Dec 21, 2025 in 181 plugins we track, by day.
12 critical 50 high 136 medium 2 low
Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.
“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.
Sunday, December 21, 2025 · 19
-
medium 6.5 WP Microdata
-
high 7.2 SureForms
-
high 8.1 Redirection for Contact Form 7
-
medium 6.4 Image Photo Gallery Final Tiles Grid
-
medium 6.4 Ultimate Member
-
medium 4.3 Web to SugarCRM Lead
-
low 2.7 WPvivid
Security issue
-
medium 6.1 Product Table for WooCommerce
-
medium 5.3 Frontend Post Submission Manager Lite
-
high 7.5 Live Composer
-
medium 5.3 Tainacan
-
medium 4.4 WC Builder
-
medium 6.4 WishSuite
-
medium 6.1 Five Star Restaurant Reservations
-
medium 4.3 WP Affiliate Disclosure
Saturday, December 20, 2025 · 13
-
medium 5.4 FiboSearch
-
medium 5.3 Ultimate Member
-
medium 4.4 Amazon affiliate lite Plugin
-
medium 5.4 Amazon affiliate lite Plugin
-
medium 5.3 F70 Lead Document Download
-
medium 5.5 RESPONSIVE AND SWIPE SLIDER!
-
critical 9.8 File Uploader for WooCommerce
-
medium 6.1 Overstock Affiliate Links
-
medium 5.3 Pretty Google Calendar
-
medium 4.3 Quran Gateway
-
medium 4.3 WP DB Booster
-
medium 6.1 WP Hallo Welt
-
medium 6.1 Attachments Handler
Friday, December 19, 2025 · 7
-
medium 5.4 Image Photo Gallery Final Tiles Grid
-
high 7.2 SlimStat Analytics
-
medium 6.4 Colibri Page Builder
-
medium 6.4 BA Book Everything
-
high 7.2 HTML5 Audio Player
-
medium 5.3 Simply Schedule Appointments
Thursday, December 18, 2025 · 75
-
medium 6.5 Post Grid
-
medium 4.3 Radius Blocks
-
medium 5.3 Post Grid
-
medium 5.0 WP AI CoPilot
-
medium 5.3 Sermon Manager
-
medium 4.3 Prime Slider
-
high 7.5 Hummingbird Performance
-
medium 4.3 Sweet Energy Efficiency
-
medium 4.3 HUSKY
-
medium 6.4 OpenID Connect Generic Client
-
high 8.8 Demo Importer Plus
-
high 7.5 Easy Form
-
high 7.1 Easy Invoice
-
medium 6.5 ERP
-
high 7.1 Hostel
-
high 7.1 Sprout Clients
-
high 7.5 MemberKits
-
high 7.1 FV Antispam
-
medium 6.5 InstaWP Connect
-
high 7.5 LearnPress
-
critical 9.1 MotoPress Hotel Booking
-
high 7.5 Property Hive
-
medium 6.5 RestroPress
-
critical 9.0 WP Webhooks
-
high 7.5 wpForo Forum
-
medium 6.5 WP Social Ninja
-
medium 6.5 All in One SEO
-
high 7.1 ANAC XML Bandi di Gara
-
high 8.8 Booking and Rental Manager for Bike
-
medium 6.5 GetResponse Official
-
medium 6.5 GetResponse Official
-
medium 6.5 Masteriyo LMS
-
high 7.5 Timetics
-
high 7.7 Filr
-
high 7.5 Follow My Blog Post
-
critical 9.8 Sprout Invoices
-
high 7.5 Passster
-
high 7.1 Mailster WordPress Newsletter Plugin
-
critical 9.8 WP Gravity Forms Constant Contact Plugin
-
critical 9.8 WP Gravity Forms FreshDesk Plugin
-
critical 9.8 WP Gravity Forms HubSpot
-
critical 9.8 WP Gravity Forms Insightly
-
critical 9.8 CRM Perks Integration for Gravity Forms and Sa…
-
critical 9.8 WP Gravity Forms Zoho CRM and Bigin
-
high 7.1 Parallax Section Block
-
medium 6.5 WebinarIgnition
-
high 7.5 WP Voting Contest Lite
-
high 8.1 affects latest 1.0.2 Anchor smooth scroll
-
high 7.5 Ray Enterprise Translation
-
high 7.5 Task Manager
-
high 7.5 YayPricing
-
critical 9.3 tPlayer
-
medium 6.5 miniOrange 2FA
-
medium 5.8 Download After Email
-
medium 6.5 Super Blank
-
medium 5.8 eRoom
-
medium 5.9 VikBooking Hotel Booking Engine & PMS
-
medium 6.5 Login Page Customizer
-
medium 6.5 Restaurant Menu and Food Ordering
-
medium 4.3 Download Manager
-
medium 6.4 Events Manager
-
medium 6.5 Get Cash
-
medium 6.5 Contact Form Email
-
medium 6.4 Embed Any Document
Wednesday, December 17, 2025 · 14
-
medium 6.4 Live Composer
-
medium 4.3 Ultimate Member
-
medium 6.4 Ultimate Member
-
medium 4.9 Zephyr Project Manager
-
medium 5.3 WPLP Cookie Consent
-
medium 4.3 Converter for Media
-
high 7.5 Ninja Forms
-
medium 6.1 Better Messages
-
medium 6.4 WP Recipe Maker
-
medium 6.5 WP Social Ninja
-
medium 6.1 HTML Forms
-
medium 6.4 Essential Addons for Elementor
-
medium 4.3 Gutenberg Essential Blocks
Tuesday, December 16, 2025 · 61
-
medium 6.4 Elementor Website Builder
-
high 8.1 WPCOM Member
-
medium 5.4 affects latest 1.0 Meks Quick Plugin Disabler
-
medium 5.4 Semrush Content Toolkit
-
medium 5.4 Ultimate WordPress Auction
-
medium 6.5 affects latest 1.2.2 User Avatar
-
medium 6.5 Essential Real Estate
-
medium 6.5 VK Google Job Posting Manager
-
high 8.5 Hydra Booking
-
medium 5.9 Document Library Lite
-
medium 5.3 Document Library Lite
-
high 7.6 Newsletter
-
medium 6.5 Watu Quiz
-
medium 6.5 WP Visitor Statistics (Real Time Traffic)
-
high 8.5 All in One SEO
-
high 7.6 Broken Link Checker by AIOSEO
-
medium 4.3 SendPulse Email Marketing Newsletter
-
medium 6.5 Stars Testimonials
-
medium 5.3 TI WooCommerce Wishlist
-
medium 6.5 WPZOOM Addons for Elementor
-
medium 5.3 Essential Real Estate
-
medium 5.3 FAPI Member
-
medium 5.3 WPLP Cookie Consent
-
medium 5.3 Pochipp
-
medium 5.3 Brevo for WooCommerce
-
medium 5.3 WP Views Counter
-
medium 5.3 Yaad Sarig Payment Gateway For WC
-
medium 5.3 CatFolders
-
medium 5.3 Leaky Paywall
-
medium 5.3 Security Optimizer
-
medium 5.3 Stylish Price List
-
medium 5.3 Ultimate WordPress Auction
-
medium 5.3 affects latest 2.0 Fix Media Library
-
medium 5.3 WP Compress for MainWP
-
medium 4.9 Business Directory Plugin
-
medium 5.3 XML Sitemap Generator for Google
-
medium 4.9 affects latest 1.7.1 Health Check & Troubleshooting
-
medium 5.3 OnPay.io for WooCommerce
-
medium 4.9 WCFM Marketplace
-
medium 4.3 Accessibility by AudioEye
-
medium 4.7 Directorist
-
medium 4.3 Read More & Accordion
-
medium 4.3 affects latest 1.5.12 Import external attachments
-
medium 5.3 Protect WP Admin
-
medium 4.3 Request a Quote
-
medium 4.3 affects latest 1.12 Restrict Elementor Widgets, Columns and Sections
-
medium 4.3 Easy Property Listings
-
medium 4.3 affects latest 2.3.4 Freshchat
-
medium 4.3 Quick Interest Slider
-
medium 4.3 affects latest 1.2 RTL Tester
-
medium 4.3 WP Coupons and Deals
-
medium 4.3 WPS Bidouille
-
medium 4.3 CM Search And Replace
-
medium 4.3 listify
-
medium 4.3 SKT Page Builder
-
low 2.7 WCFM
-
medium 5.3 JetFormBuilder
-
medium 4.3 Auto Featured Image (Auto Post Thumbnail)
-
medium 5.3 LearnPress
Monday, December 15, 2025 · 11
-
high 7.5 Booking Calendar
-
critical 9.8 Fox LMS
-
medium 6.4 CC Child Pages
-
medium 6.4 RegistrationMagic
-
medium 6.4 FluentAuth
-
medium 4.3 Modula Image Gallery
-
medium 5.3 OneSignal
-
medium 6.4 User Registration & Membership
-
medium 4.3 FileBird
-
high 7.1 URL Shortify
-
high 7.1 URL Shortify
Ran a vulnerable version? Check your site for signs of a hack
The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.
Browse vulnerabilities
Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution
Where this data comes from
- Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Plugin versions, update dates and install counts: the wordpress.org Plugins API.
- These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.