WordPress Vulnerability Report — January 22, 2025

Since our last report, 486 vulnerabilities have been publicly disclosed. 393 of the vulnerable plugins and themes remain unpatched.

Unfortunately, cyberattacks are increasing in volume and sophistication. They’re also increasingly aimed at small to mid-sized businesses.

Along with poor user account security, vulnerable plugins & themes are one of the main reasons WordPress websites get hacked, so run those updates.

If this seems overwhelming, talk to us about a Website Care Plan.

WordPress Core

No vulnerabilities disclosed!

WordPress Themes

Themes With No Fix/Patch Available

Disclosed vulnerability(ies) have not yet been patched. You should deactivate the themes(s).

  • Multifox
  • my money
  • The Ultralight
  • TIJAJI
  • CarZine
  • Envo Multipurpose
  • Flashy
  • ghostwriter
  • Js O3 Lite
  • moseter
  • my depressive
  • my engine
  • my white
  • my zebra
  • offset writing
  • polka dots
  • RealHomes
  • Sandbox
  • Tantyyellow
  • Tiki Time
  • Tuaug4

Themes With A Fix/Patch Available

Disclosed vulnerability(ies) have been patched. You should update to the latest version.
  • Betheme
  • Buzz Club
  • DWT – Directory & Listing

Looking for peace of mind and less tech stress?​

Security, performance, backups, privacy, and much more – the list of tasks needed to keep your website performing at its peak can seem overwhelming and time-consuming.

Signup for one of our website care/management plans and get a tech-savvy team who are committed to your business.

Never worry about your website again.

Let Us Help You

WordPress Plugins

Plugins With No Fix/Patch Available

Disclosed vulnerability(ies) have not yet been patched. You should deactivate the plugin(s).

  • Post and Page Builder
  • CoDesigner
  • Bold pagos en linea
  • GSheetConnector for Forminator Forms
  • Post Carousel & Slider
  • Product Carousel For WooCommerce
  • WP Headmaster
  • Course Booking System
  • Neon Product Designer
  • Partners
  • Online Payments
  • WP Order By
  • WR Price List Manager For Woocommerce
  • Estatebud
  • Amber
  • Multilang Contact Form
  • Responsive jQuery Slider
  • Gallery and Lightbox
  • User Management
  • WP Post Corrector
  • Foundation Columns
  • Navigation Du Lapin Blanc
  • WordPress HelpDesk & Support Ticket System Plugin
  • S-DEV SEO
  • SetMore Theme – Custom Post Types
  • Social Media Engine
  • WP ViewSTL
  • HireHive Job Plugin
  • Ajax Contact Form
  • Related Post Shortcode
  • CodeBard Help Desk
  • 1003 Mortgage Application
  • a Gateway for Pasargad Bank on WooCommerce
  • Ad Blocking Detector
  • add custom google tag manager
  • Add RSS
  • Admin Cleanup
  • Admin Menu Organizer
  • Elementor AI Addons
  • AI Responsive Gallery Album
  • Ajax WP Query Search Filter
  • AlT Report
  • Altima Lookbook Free for WooCommerce
  • amr personalise
  • Annie
  • Anonymize Links
  • AnyRoad
  • Apply with LinkedIn buttons
  • Auphonic Importer
  • Auto FTP
  • Background animation blocks
  • Background Control
  • Better Protected Pages
  • Bible Embed
  • Bit.ly linker
  • BizLibrary
  • Blog Summary
  • Blogger Image Import
  • Blrt WP Embed
  • Blue Wrench Video Widget
  • Board Election
  • Bonjour Bar
  • Book a Place
  • Bookalet
  • Brizy Pro
  • Calendi
  • Call me Now
  • Call To Action Popup
  • CAMOO SMS
  • Captchelfie – Captcha by Selfie
  • Car Demon
  • Category D3 Tree
  • Category Custom Fields
  • CC Circle Progress Bar
  • Contact Form 7 – CCAvenue Add-on
  • Charity-thermometer
  • Chatter
  • Chess Tempo Viewer
  • CJ Custom Content
  • CMC MIGRATE
  • CNZZ&51LA for WordPress
  • Comment-Emailer
  • HyperComments
  • Compare Ninja
  • Contact Form 7 Anti Spambot
  • Contact Form 7 Round Robin Lead Distribution
  • Contact Form Master
  • Content Mirror
  • Content Planner
  • Content Security Policy Pro
  • ContentOptin Lite
  • Cookie Consent & Autoblock for GDPR/CCPA
  • Copy Move Posts
  • Copyright Safeguard Footer Notice
  • Custom CSS Addons
  • Custom List Table Example
  • Custom Post
  • Custom Post Type Lockdown
  • Custom Widget Classes
  • Customizable Captcha and Contact Us
  • Cyber Slider
  • Daily Proverb
  • Database Sync
  • DD Roles
  • Debt Calculator
  • Debug Tool
  • DF Draggable
  • dForms
  • WordPress Local SEO
  • REAL WordPress Sidebar
  • EU DSGVO Helper
  • Easy Automatic Newsletter Lite
  • Easy Code Snippets
  • Easy EU Cookie law
  • Easy FAQs
  • Easy Filtering
  • Easy Portfolio
  • Post-to-Post Links
  • Easy Real Estate
  • Easy Shortcode Buttons
  • Easy Tweet Embed
  • Easy Tynt
  • ECT Add to Cart Button
  • EditionGuard for WooCommerce – eBook Sales with DRM
  • EELV Newsletter
  • Email Capture & Lead Generation
  • Email on Publish
  • EmailShroud
  • iSpring Embedder
  • Enhanced YouTube Shortcode
  • Error Notification
  • Event Countdown Timer Plugin by TechMix
  • Event Registration Calendar By vcita
  • Explara Membership
  • Explore pages
  • Extra Options – Favicons
  • EZPlayer
  • Fast Tube
  • FAT Event Lite
  • Feedburner Optin Form
  • Find Your Reps
  • Flexible Blogtitle
  • Floatbox Plus
  • Flying Twitter Birds
  • FontAwesome.io ShortCodes
  • Formatted post
  • FP RSS Category Excluder
  • FWD Slider
  • GDPR Personal Data Reports
  • GDReseller
  • Genki Announcement
  • Geotagged Media
  • Multi Uploader for Gravity Forms
    Giveaways and Contests by PromoSimple
  • Glofox Shortcodes
  • GMap Shortcode
  • GMAPS for WPBakery Page Builder Free
  • go Social
  • Goldstar
  • Good Old Gallery
  • WordPress Google Map Professional
  • Google Org Chart
  • WordPress Graphs & Charts
  • GravatarLocalCache
  • Greek Namedays Widget From Eortologio.Net
  • Group category creator
  • Hack me if you can
  • History timeline
  • Horizontal Line Shortcode
  • Hotspots Analytics
  • HTTP to HTTPS link changer by Eyga.net
  • Gallery: Hybrid – Advanced Visual Gallery
  • CtyGrid Hyp3rL0cal Search
  • Image Gallery Box by CRUDLab
  • Image Switcher
  • imaGenius
  • Import Users to MailChimp
  • Improved Sale Badges – Free Version
  • Incredible Font Awesome
  • InFunding
  • Instant Appointment
  • Interactive Page Hierarchy
  • JB Horizontal Scroller News Ticker
  • Jet Skinner for BuddyPress
  • Kapost
  • Kopa Nictitate Toolkit
  • Len Slider
  • LH Email
  • LH Login Page
  • Lime Developer Login
  • LocalGrid
  • Loginplus
  • LSD Google Maps Embedder
  • MACME
  • Magic Google Maps
  • Free MailClient FMC
  • Mapbox for WP Advanced
  • Mark Posts
  • Marmoset Viewer
  • Marquee Style RSS News Ticker
  • Mass Custom Fields Manager
  • Mass Messaging in BuddyPress
  • MD Custom content after or before of post
  • MDC YouTube Downloader
  • MeinTurnierplan.de Widget Viewer
  • MemeOne
  • Menus Plus+
  • MercadoLibre Integration
  • MFPlugin
  • MHR-Custom-Anti-Copy
  • Mindmeister Shortcode
  • More Link Modifier
  • WP VTiger Synchronization
  • Metaphor Widgets
  • Muzaara Google Ads Report
  • my-related-posts
  • MyAnime Widget
  • mybb Last Topics
  • MyBookProgress by Stormhill Media
  • Nativery
  • Nite Shortcodes
  • NV Slider
  • OrangeBox
  • Password Protect Plugin for WordPress
  • Pastebin
  • PayForm
  • PayPal Marketing Solutions
  • PDF.js Shortcode
  • Powie’s pLinks PagePeeker
  • Pod?lánková inzerce
  • Pootle button
  • Popliup
  • Post & Page Notes
  • PPO Call To Actions
  • Preloader Quotes
  • Progress Tracker
  • QR Code Generator
  • Quick Count
  • quote-posttype-plugin
  • QuoteMedia Tools
  • ReadMe Creator
  • Realty Workstation
  • REDIRECTION PLUS
  • User Sync ActiveCampaign
  • Rezdy Reloaded
  • Rename Author Slug
  • Links/Problem Reporter
  • Responsivity
  • Rio Photo Gallery
  • Rollover Tab
  • root Cookie
  • RSS Icon Widget
  • RSS News Scroller
  • RSV GMaps
  • Salvador – AI Image Generator
  • Scroll Top Advanced
  • Secure CAPTCHA
  • Real Seguro Viagem
  • Send to a Friend Addon
  • Send to Twitter
  • SOCIAL.NINJA
  • SexBundle
  • Shabbos and Yom Tov
  • Shockingly Big IE6 Warning
  • Shortcode in Comment
  • Shoutcast and Icecast HTML5 Web Radio Player
  • Sidebar-Content from Shortcode
  • Simple Custom post type custom field
  • Simple Project Manager
  • Simple shortcode buttons
  • Simple Vertical Timeline
  • Slides & Presentations
  • Slider for Writers
  • Smallerik File Browser
  • Smooth Dynamic Slider
  • Cache Sniper for Nginx
  • Snippy
  • Social Analytics
  • Social Pug: Author Box
  • Social2Blog
  • Solidres – Hotel booking plugin
  • Spiderpowa Embed PDF
  • SEOReseller Partner
  • Staging CDN
  • Stars SMTP Mailer
  • Strx Magic Floating Sidebar Maker
  • Style Admin
  • Sur.ly
  • Tab My Content
  • Tagesteller
  • Team 118GROUP Agent
  • Theme My Ontraport Smartform
  • Top Flash Embed
  • Track Page Scroll
  • Translation.Pro
  • ts-tree
  • Twitter Bootstrap Collapse
  • Twitter Shortcode
  • Twitter Post
  • Ultimate Events
  • Ultimate Subscribe
  • Unique UX
  • Universal Analytics Injector
  • UpDownUpDown
  • user files
  • Utilities for MTG
  • Nature FlipBook
  • ViewMedica 9
  • Visit Site Link enhanced
  • W3SPEEDSTER
  • WCS QR Code Generator
  • Weaver Themes Shortcode Compatibility
  • Web Push
  • Web Testimonials
  • WH Cache & Security
  • Wibstats
  • Winning Portfolio
  • WM Options Import Export
  • Woo Tuner
  • WooCommerce Order Search
  • WOOEXIM
  • Word Freshener
  • WordPress Custom Sidebar
  • WordPress Data Guard
  • WordPress Gallery Plugin
  • WordPress Logging Service
  • WP All Import Pro
  • wp_amaps
  • WP-Announcements
  • WP Background Tile
  • WP-BlackCheck
  • WP Block Pack
  • WP Bulletin Board
  • WP Cookies Alert
  • WP Custom Google Search
  • WP Download Codes
  • WP FixTag
  • WP IMAP Auth
  • WP Intro.JS
  • WP krpano
  • Lijit Search
  • WP Load Gallery
  • WP Meetup
  • WP News Sliders
  • WP Options Editor
  • wp-pano
  • WP Panoramio
  • WP Photo Sphere
  • WP-Player
  • WP PT-Viewer
  • WP-Revive Adserver
  • Wp-Scribd-List
  • SendGrid for WordPress
  • WP Service Payment Form With Authorize.net
  • WP2APP
  • WPDB to Sql
  • WpF Ultimate Carousel
  • WordPress File Search
  • WP Journal
  • WP Lyrics
  • XLSXviewer
  • Xola
  • Yet Another Countdown
  • yCyclista
  • Zarinpal Paid Download

Plugins With A Fix/Patch Available

The vulnerability(ies) have been patched. You should update to the latest version.

  • UpdraftPlus
  • W3 Total Cache
  • Page Builder by SiteOrigin
  • Royal Elementor Addons and Templates
  • Ultimate Membe
  • Elementor Addon Elements
  • Advanced File Manager
  • NitroPack
  • Widget Options
  • List category posts
  • Email Subscribers by Icegram Express
  • Kubio AI Page Builder
  • WP ULike
  • WP Booking Calendar
  • Easy Digital Downloads
  • Piotnet Addons For Elementor
  • Post Grid and Gutenberg Blocks
  • HTML5 Video Player
  • Social Share, Social Login and Social Comments
  • VOD Infomaniak
  • Appointment Booking Calendar Plugin and Scheduling
  • Link Library
  • Multi Step Form
  • Paid Membership Subscriptions
  • WooCommerce Advanced Bulk Edit Products, Orders, Coupons, Any WordPress Post Type
  • Payment Button for PayPal
  • WP User Profile Avatar
  • Motors – Car Dealer, Classifieds & Listing
  • WP Hotel Booking
  • Proofreading
  • ElementInvader Addons
  • Podlove Podcast Publisher
  • Button Block
  • ApplyOnline
  • MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder
  • Tag Groups is the Advanced Way to Display Your Taxonomy Terms
  • Eventer
  • Flexible PDF Coupons
  • WordPress CRM, Email & Marketing Automation for WordPress
  • Htaccess File Editor
  • Image Source Control Lite
  • Barcode Scanner (+Mobile App)
  • Checkout for PayPal
  • MarketKing
  • Social proof testimonials and reviews
    WordPress Tour & Travel Booking Plugin for WooCommerce
  • WP Inventory Manager
  • The Ultimate WordPress Toolkit
  • My Tickets
  • Taskbuilder
  • FireCask Like & Share Button
  • My auctions allegro
  • Verge3D Publishing and E-Commerce
  • PDF for WPForms + Drag and Drop Template Builder
  • Simple:Press Forum
  • VikAppointments Services Booking Calendar
  • Admin and Customer Messages After Order for WooCommerce
  • Chamber Dashboard Business Directory
  • Picture Gallery – Frontend Image Uploads, AJAX Photo List
  • Stop Comment Spam
  • WP Smart TV
  • ShipWorks Connector for Woocommerce
    turboSMTP
  • aDirectory – WordPress Directory Listing Plugin
  • Build Private Store For Woocommerce
  • Awesome Responsive Photo Gallery
  • Evergreen Content Poster
  • Moving Users
  • Passwords Manager
  • Video Share VOD
  • WP-BibTeX
  • Rate Star Review Vote
  • MicroPayments
  • Webcamconsult
  • wp-greet
  • JSM Screenshot Machine Shortcode
  • WP Responsive Tabs
  • Posts Footer Manager
  • Adifier System
  • Gravity Forms
  • JetElements For Elementor
  • JetEngine
  • Tamara Checkout

How Do I Update WordPress?

Run a full backups of your website using the backup plugin you have installed -or- using the backup feature your web host provides.

Ideally you test major functions – like ecommerce, elearning, membership functionality on a staging server first. If you site is “heavily” customized, you should also test in a staging environgment first.

Perform your updates in the order of WordPress – Theme(s) – Plugin(s). Ideally you are making note of the before and after versions.

After completed, perform a visual inspection of your site and test critical functionality that may have been affected – contact forms, subscription buttons, purchasing etc.