WordPress Vulnerability Report — April 30, 2025
Since our last report, 241 vulnerabilities have been publicly disclosed. 150 of the vulnerable plugins and themes remain unpatched.
Unfortunately, cyberattacks are increasing in volume and sophistication. They’re also increasingly aimed at small to mid-sized businesses.
Along with poor user account security, vulnerable plugins & themes are one of the main reasons WordPress websites get hacked, so run those updates.
If this seems overwhelming, talk to us about a Website Care Plan.
WordPress Core
No vulnerabilities disclosed!
WordPress 6.8 “Cecil” is here! Launched April 15, 2025, it honors jazz legend Cecil Taylor, whose pioneering piano fused chaos and harmony. Explore its bold features with the same experimental spirit.
WordPress Themes
Themes With No Fix/Patch Available
Disclosed vulnerability(ies) have not yet been patched. You should deactivate the themes(s).
- Arrival
- CWW Portfolio
- Grace Mag
- Opstore
- Xews Lite
- Altair
- Hotel + Bed and Breakfast Booking Calendar Theme
- CiyaShop
- Grand Restaurant WordPress
- JNews
- Reales WP
Themes With A Fix/Patch Available
Disclosed vulnerability(ies) have been patched. You should update to the latest version.
- EduMall
- Kleo
- Vikinger
- wProject
Looking for peace of mind and less tech stress?
Security, performance, backups, privacy, and much more – the list of tasks needed to keep your website performing at its peak can seem overwhelming and time-consuming.
Signup for one of our website care/management plans and get a tech-savvy team who are committed to your business.
Never worry about your website again.
Let Us Help YouWordPress Plugins
Plugins With No Fix/Patch Available
Disclosed vulnerability(ies) have not yet been patched. You should deactivate the plugin(s).
- Advanced Accordion Gutenberg Block
- Lottie Player
- ACF: Google Font Selector
- Anything Popup
- The Pack Elementor addon
- WPMasterToolKit
- Spreadsheet Price Changer for WooCommerce and WP E-commerce
- Capturly
- Checkout Field Visibility for WooCommerce
- Product Lister for eBay
- FuseDesk
- Appsero Helper
- 1 Decembrie 1918
- 360 View
- Form Builder
- Absolute LinksAdd custom page templateAdd Google +1 (Plus one) social share Button
- Custom Admin-Bar Favorites
- Advanced lazy load
- All in One Time Clock Lite
- Ajax Comment Form CST
- Configurator Theme Core
- Animate
- Author Box After Posts
- Author Box Plugin With Different Description
- Availability Calendar
- Awesome Wp Image Gallery
- BBCode Deluxe
- Best Posts Summary
- Blog Manager WP
- Buddypress Force Password Change
- Business Contact Widget
- Call Now PHT Blog
- Car Park Booking System for WordPress
- Carousel-of-post-images
- Contact Form 7 Calendar
- CheckBot
- Confirm User Registration
- COVID-19 Update Your Customers
- Custom Functions Plugin
- WP Custom Post Popup
- LSD Custom taxonomy and category meta
- Document Management System
- Drop Caps
- Dropdown Content
- Easy Child Theme Creator
- Enhanced Paypal Shortcodes
- External Markdown
- FAT Services Booking
- Flickr Shortcode Importer
- Floating Social Bar
- Flynax Bridge
- Foodbakery Sticky Cart
- Front End Users
- Frontend Login and Registration Blocks
- GNA Search Shortcode
- Peadig’s Google +1 Button
- Google News
- Grand Conference
- Tabs
- GTDB Guitar Tuners
- Hacklog Remote Attachment
- Smart Hashtags
- Hospital Management System
- iCafe Library
- Image Style Hover
- Image Hover Effects For WPBakery Page Builder
- Inline Text Popup
- Integração entre Eduzz e Woocommerce
- Landing pages and Domain aliases for WordPress
- Libro de Reclamaciones
- License For Envato
- Mad Mimi for WordPress
- Milat jQuery Automatic Popup
- Mini twitter feed
- Mixcloud Embed
- Modern Polls
- Custom Login and Registration
- Multi-Column Taxonomy List
- My Custom Widgets
- Navegg Analytics
- Nepali Post Date
- occupancyplan
- PayPal Express Checkout
- Peekaboo
- Plugin Central
- Posts for Page
- Print Science Designer
- RAphicon
- Related Posts via Taxonomies
- Loan Calculator
- Revy
- SUMO Reward Points
- RRSSB
- SCSS-Library
- Send From
- SEUR Oficial
- Simple Google Photos Grid
- Social Counter
- Tayori Form
- Time Based Greeting
- Twitter Card Generator
- Unsafe Mimetypes
- Vasaio QR Code
- WP Vegas
- Verification SMS with TargetSMS
- Bulk Assign Linked Products For WooCommerce
- WP AVCL Automation Helper
- Plugin Upgrade Time Out
- WoWHead Tooltips
- WP Cookie Consent
- Wp Custom CMS Block
- WP Customize Login Page
- wp-cyr-cho
- Easy Guide
- WP Filter Post Category
- FoodBakery
- WP HRM LITE
- JobSearch
- Meta Keywords & Description
- WP Quiz
- WP-reCAPTCHA-bp
- Tooltip
- WordPress Events Calendar Registration & Tickets
- WPVN
- WpZon – Amazon Affiliate Plugin
- Force Login Page
- Woocommerce Automatic Order Printing
- Xpert Tab
- Zalo Official Live Chat
- Zoho Creator Forms
Plugins With A Fix/Patch Available
The vulnerability(ies) have been patched. You should update to the latest version.
- Ocean Extra
- Admin and Site Enhancements (ASE)
- Element Pack Addons for Elementor
- ShopLentor
- Jupiter X Core
- Icegram Express
- User Registration & Membership
- Category Posts Widget
- Greenshift
- WordPress Tag, Category, and Taxonomy Manager
- Visual Composer Website Builder
- WP Import Export Lite
- Contact Form & SMTP Plugin
- SecuPress Free
- Gutenverse
- Social Slider Feed
- PowerPress Podcasting plugin by Blubrry
- UiCore Elements
- Icegram Engage
- Seriously Simple Podcasting
- AFI – The Easiest Integration Plugin
- Alt Text AI
- GutenKit
- HTML Forms
- Link Library
- Mang Board WP
- Prevent Direct Access
- WordPress Simple Shopping Cart
- Contact Form by Bit Form
- WS Form LITE
- Theme Switcha
- Custom Related Posts
- Upsell Funnel Builder for WooCommerce
- Watu Quiz
- affiliate-toolkit
- Message Filter for Contact Form 7
- SKT Blocks
- Sky Addons for Elementor
- WP-Recall
- Appointment Booking Calendar
- Event post
- Fable Extra
- List Last Changes
- Simple Download Counter
- Image Optimizer, Resizer and CDN
- Smart Maintenance Mode
- My Tickets
- MPL-Publisher
- Frontend Dashboard
- Media Library Downloader
- Popup Builder
- VikRestaurants Table Reservations and Take-Away
- Textmetrics
- CM Answers
- Crossword Compiler Puzzles
- Advanced Linked Variations for Woocommerce
- Simple calendar for Elementor
- Tax Switch for WooCommerce
- Lifetime free Drag & Drop Contact Form Builder for WordPress VForm
- CM Ad Changer
- Mailing Group Listserv
- Able Player, accessible HTML5 media player
- Recover abandoned cart for WooCommerce
- Breeze Display
- Control Listings
- Aeropage Sync for Airtable
- AnalyticsWP
- Anps Theme
- BeerXML Shortcode
- BM Content Builder
- cookieBAR
- Mayosis Core
- Memberpress
- Order Delivery Date for WP e-Commerce
- Post in page for Elementor
- Service Finder Booking
- Form
- Xpro Elementor Addons – Pro
How Do I Update WordPress?
Run a full backups of your website using the backup plugin you have installed -or- using the backup feature your web host provides.
Ideally you test major functions – like ecommerce, elearning, membership functionality on a staging server first. If you site is “heavily” customized, you should also test in a staging environgment first.
Perform your updates in the order of WordPress – Theme(s) – Plugin(s). Ideally you are making note of the before and after versions.
After completed, perform a visual inspection of your site and test critical functionality that may have been affected – contact forms, subscription buttons, purchasing etc.