WordPress Vulnerability Report — January 8, 2025
Since our last report, 228 vulnerabilities have been publicly disclosed. 131 of the vulnerable plugins and themes remain unpatched.
Unfortunately, cyberattacks are increasing in volume and sophistication. They’re also increasingly aimed at small to mid-sized businesses.
Along with poor user account security, vulnerable plugins & themes are one of the main reasons WordPress websites get hacked, so run those updates.
If this seems overwhelming, talk to us about a Website Care Plan.
WordPress Core
WordPress Themes
Themes With No Fix/Patch Available
Disclosed vulnerability(ies) have not yet been patched. You should deactivate the themes(s).
- Store Commerce
- Aports
- Boliin
- Constix
- Conult
- Digi Store
- Education LMS
- Fioxen
- TheFude
- Gowilds
- Halpes
- Lestin
- Modins
- Orgarium
- Paroti
- Pisole
- Qempo
- Qizon
- Sominx
- Tevily
- welow
- SimpleCharm
- Aurum
Themes With A Fix/Patch Available
Disclosed vulnerability(ies) have been patched. You should update to the latest version.- Aurum
- SimpleCharm
WordPress Plugins
Plugins With No Fix/Patch Available
Disclosed vulnerability(ies) have not yet been patched. You should deactivate the plugin(s).
- Smart Custom Fields
- Gutentor – Gutenberg Blocks
- Link Whisper Free
- WP Visitor Statistics
- Thim Elementor Kit
- MashShare
- TemplatesNext ToolKit
- WP FullCalendar
- Product Table for WooCommerce
- Hash Elements
- Design for Contact Form 7
- CubeWP Forms
- ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes
- SpeakOut! Email Petitions
- DynamicTags
- BSK Forms Blacklist
- Bus Ticket Booking with Seat Reservation
- DirectoryPress
- Hero Banner Ultimate
- Typing Text
- Custom Field For WP Job Manager
- FancyPost
- Build App Online
- WordLift
- ClickWhale
- SMSA Shipping
- WP Youtube Gallery
- ElementsCSS Addons for Elementor
- NAVER Analytics
- ThePerfectWedding.nl Widget
- Hide Category by User Role for WooCommerce
- Rezgo Online Booking
- Standard Box Sizes
- ARS Affiliate Page Plugin
- ProductDyno
- SSL Wireless SMS Notification
- Image Hover Effects for Elementor
- WP SecureSubmit
- Chative Live chat and Chatbot
- EO4WP: EmailOctopus for WordPress
- 5centsCDN
- ACH Invoicing Plugin
- Contact Form 7 Database
- Wp advertising management
- AHAthat
- Allada T-shirt Designer for Woocommerce
- ARPrice
- Autocompleter
- Bizapp for WooCommerce
- BVD Easy Gallery Manager
- Candifly
- Chatroll Live Chat
- ClickDesigns
- Common Ninja
- Duplicate Post, Page and Any Custom Post
- Elevio
- EMC2 Alert Boxes
- Enable Accessibility
- Fancy Product Designer
- Formaloo Form Maker
- GDY Modular Content
- Geo Content
- Hero Mega Menu
- Host PHP Info
- Ultimate Learning Pro
- LazyLoad Background Images
- Marketplace Items
- Meteor Slides
- MG Parallax Slider
- Opencart Product in WP
- OZ Canonical
- PayGreen Payment Gateway
- RightMessage WP
- Kikx Simple Post Author Filter
- School Management System
- Sell Media
- Sellsy
- SEO LAT Auto Post
- Simple Add Pages or Posts
- Slider Pro Lite
- Social Rocket
- Spacer
- SweepWidget Contests, Giveaways, Photo Contests, Competitions
- SyncFields
- WP-tagMaker
- Target Notifications
- Themes Coder
- Timeline Designer
- Transporters.io
- Private Messages for UserPro
- ViewMedica 9
- WC1C
- Wizhi Multi Filters by Wenprise
- Binary MLM Woocommerce
- Woo Ukrposhta
- WooCommerce Digital Content Delivery (incl. DRM)
- Live Sales Notification for Woocommerce
- WordPress Auction Plugin
- WP Simple Sitemap
- WPAchievements Free
- wpSOL
- Custom Product Tabs for WooCommerce
Plugins With A Fix/Patch Available
The vulnerability(ies) have been patched. You should update to the latest version.
- WPForms
- UpdraftPlus
- Envato Elements
- Ninja Forms
- WPvivid Backup & Migration
- PixelYourSite
- Astra Widgets
- Pods
- WordPress Popular Posts
- Backup Migration
- Email Subscribers by Icegram Express
- Media Library Assistant
- Piotnet Addons For Elementor
- Compact WP Audio Player
- Master Addons
- Data Tables Generator
- MP3 Audio Player
- Post Grid Elementor Addon
- AFI – The Easiest Integration Plugin
- AyeCode Connect
- Export Import Menus
- GeoDirectory
- Mang Board WP
- WP Post Author
- Export All Posts, Products, Orders, Refunds & Users
- WP Project Manager
- Nexter Blocks
- WP Compress
- WPSSO Core
- WP Job Portal
- Arconix Shortcodes
- Magazine Blocks
- WPKoi Templates for Elementor
- Ashe Extra
- Move Addons for Elementor
- Classic Addons – WPBakery Page Builder
- Groundhogg
- MyBookTable Bookstore
- Premium Blocks
- Pronamic Google Maps
- WPBITS Addons For ElementorWP
- Wand
- AI WP Writer
- Accessibility by AllAccessible
- Enter Addons for Elementor
- Locatoraid Store Locator
- Themify Audio Dock
- WP Docs
- Photo Gallery Slideshow & Masonry Tiled Gallery
- WP Smart Import
- ConvertCalculator for WordPress
- Event Espresso
- WP Social AutoConnectHestia
- Nginx Cache
- Dynamics 365 Integration
- Just Writing Statistics
- Taskbuilder
- WP jQuery DataTable
- One to one user Chat
- WPMasterToolKit (WPMTK)
- AI for SEO
- Service Box
- WP Multi Store Locator
- Scratch & Win
- WP Mailster
- ACF City Selector
- CC Canadian Mortgage Calculator
- Multiple Shipping And Billing Address For Woocommerce
- Email Reminders
- Project Showcase
- Turnkey bbPress by WeaverTheme
- Interactive UK Map
- JobBoard
- Pretty Simple Popup Builder
- PlainInventory
- Notify Odoo
- Error Log Viewer By WP Guru
- Hive Support
- GS Shots for Dribbble
- Highlight Sitewide Notice, Text, Button Menu
- GS Coaches
- WPMozo Addons Lite for Elementor
- Coins MarketCap
- Floating Action Buttons
- Goodlayers Core
- ShopElement
- Tourmaster
Looking for peace of mind and less tech stress?
Security, performance, backups, privacy, and much more – the list of tasks needed to keep your website performing at its peak can seem overwhelming and time-consuming.
Signup for one of our website care/management plans and get a tech-savvy team who are committed to your business.
Never worry about your website again.
Let Us Help YouHow Do I Update WordPress?
Run a full backups of your website using the backup plugin you have installed -or- using the backup feature your web host provides.
Ideally you test major functions – like ecommerce, elearning, membership functionality on a staging server first. If you site is “heavily” customized, you should also test in a staging environgment first.
Perform your updates in the order of WordPress – Theme(s) – Plugin(s). Ideally you are making note of the before and after versions.
After completed, perform a visual inspection of your site and test critical functionality that may have been affected – contact forms, subscription buttons, purchasing etc.