WordPress Vulnerability Report — February 12, 2025
Since our last report, 155 vulnerabilities have been publicly disclosed. 101 of the vulnerable plugins and themes remain unpatched.
Unfortunately, cyberattacks are increasing in volume and sophistication. They’re also increasingly aimed at small to mid-sized businesses.
Along with poor user account security, vulnerable plugins & themes are one of the main reasons WordPress websites get hacked, so run those updates.
If this seems overwhelming, talk to us about a Website Care Plan.
WordPress Core
WordPress Themes
Themes With No Fix/Patch Available
Disclosed vulnerability(ies) have not yet been patched. You should deactivate the themes(s).
- OnePress
Themes With A Fix/Patch Available
Disclosed vulnerability(ies) have been patched. You should update to the latest version.
- DWT – Directory & Listing
- SocialV
- Zox News
Looking for peace of mind and less tech stress?
Security, performance, backups, privacy, and much more – the list of tasks needed to keep your website performing at its peak can seem overwhelming and time-consuming.
Signup for one of our website care/management plans and get a tech-savvy team who are committed to your business.
Never worry about your website again.
Let Us Help YouWordPress Plugins
Plugins With No Fix/Patch Available
Disclosed vulnerability(ies) have not yet been patched. You should deactivate the plugin(s).
- WP Project Manager
- Payment Forms for Paystack
- Eventer
- Blog, Posts and Category Filter for Elementor
- Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce
- Job Board Manager
- Paytm Payment Donation
- Stylish Google Sheet Reader 4.0
- Music Press Pro
- Image Rotator
- All push notification for WP
- Print PDF Generator and Publisher
- AIO Performance Profiler, Monitor, Optimize, Compress & Debug
- Appointment Buddy Widget
- Notification Bar
- Auto SEO
- Banner Garden
- BookPress – For Book Authors
- Breaking News Ticker
- Builder Shortcode Extras
- Child Themes Helper
- Custom Comment Notifications
- Custom Links On Admin Dashboard Toolbar
- CWD – Stealth Links
- Easy Chart Builder for WordPress
- Easy Related Posts
- Easy WP Tiles
- Embed RSS
- External Video For Everybody
- Facilita Form Tracker
- Status UpdaterFle
- xIDX Home Search
- Fyrebox Quizzes
- Giga Messenger – Express
- GlobalQuran
- Glossy
- URL-Preview-Box
- Google Earth Embed
- Graceful Email Obfuscation
- iBuildApp
- Indeed API
- Infusionsoft AnalyticsInLocation
- JustRows freeEvent
- Kikfyre
- Kona Gallery Block
- Legull
- LikeBot
- Link to URL / Post
- Links in Captions
- Login-box
- Munk Sites
- Musicbox
- NextGen Cooliris Gallery
- OneStore Sites
- On Page SEO + Whatsapp Chat Button
- Optimate Ads
- Pop Up
- Quote Comments
- Read More Copy Link
- Responsive iframe
- ReverbNation Widgets
- RSS in Page
- Show notice or message on admin area
- Simple Add Pages or Posts
- Simple Auto Tag
- Simple Select All Text Box
- Simple User Profile
- Slide Banners
- Smart Countdown FX
- Smart DoFollow
- Songkick Concerts and Festivals
- Starter Templates by FancyWP
- Style Tweaker
- Theasys
- Theme Options Z
- TransFinanz
- Vignette Ads
- VR-Frases
- WizShop
- WP Admin Custom Page
- WP Custom Post RSS Feed
- WP Directorybox Manager
- WP Dream Carousel
- WP Email Newsletter
- WP FinanceFoodBakery
- WP Keyword Monitor
- WP Projects Portfolio
- WP SimpleWeather
- WP Social StreamWP Spell Check
- WP doodlez
- ZMSEO
Plugins With A Fix/Patch Available
The vulnerability(ies) have been patched. You should update to the latest version.
- WPForms
- Qi Addons For Elementor
- Orbit Fox by ThemeIsle
- The Plus Addons for Elementor
- Import any XML, CSV or Excel File to WordPress
- HT Mega – Absolute Addons For Elementor
- Post and Page Builder by BoldGridDynamic Conditions
DSGVO All in one for WP - CURCY – Multi Currency for WooCommerce
- Better Messages
- EAN Barcode Generator for WooCommerce
- GeoDirectory
- Sensei LMS
- VikBooking Hotel Booking Engine & PMS
- JS Help Desk
- WP Job Portal
- Survey Maker
- B Slider- Gutenberg Slider Block for WP
- Product Blocks for WooCommerce
- aThemes Addons for Elementor
- Medical Addon for Elementor
- SendPulse Email Marketing Newsletter
- Directory Listings WordPress plugin
- SuperSaaS
- RapidLoad AI
- Include Mastodon Feed
- Product Table For WooCommerce
- Alert Box Block
- Uix Shortcodes
- Disable Elementor Editor Translation
- Listings for Appfolio
- Export Order, Product, Customer & Coupon for WooCommerce to Google Sheets
- Contact Manager
- Video & Photo Gallery for Ultimate Member
- ShopSite
- Awesome Event Booking
- Admin and Site Enhancements (ASE) Pro
- BoomBox Theme Extensions
- Nextend Social Login Pro
- Super Store Finder
- WooCommerce Support Ticket System
- WP ALL Export Pro
- WP All Import Pro
How Do I Update WordPress?
Run a full backups of your website using the backup plugin you have installed -or- using the backup feature your web host provides.
Ideally you test major functions – like ecommerce, elearning, membership functionality on a staging server first. If you site is “heavily” customized, you should also test in a staging environgment first.
Perform your updates in the order of WordPress – Theme(s) – Plugin(s). Ideally you are making note of the before and after versions.
After completed, perform a visual inspection of your site and test critical functionality that may have been affected – contact forms, subscription buttons, purchasing etc.