WordPress Vulnerability Report —July 2, 2025
Since our last report, 213 vulnerabilities have been publicly disclosed. 149 of the vulnerable plugins and themes remain unpatched.
Unfortunately, cyberattacks are increasing in volume and sophistication. They’re also increasingly aimed at small to mid-sized businesses.
Along with poor user account security, vulnerable plugins & themes are one of the main reasons WordPress websites get hacked, so run those updates.
If this seems overwhelming, talk to us about a Website Care Plan.
WordPress Core
No vulnerabilities disclosed!
WordPress 6.8.1 has been released! This maintenance release includes fixes for 15 bugs throughout Core and the Block Editor, addressing issues affecting multiple areas of WordPress, including the block editor, multisite, and REST API. For a full list, refer to the release candidate announcement.
WordPress Themes
Themes With No Fix/Patch Available
- Constructor
- Zita
- PrintXtore
- Zenny
- CityGov
- Domnoo
- Homey
- Katerio – Magazine
- LMS
- LogisticsHub
- MagOne
- MBStore
- Nuss
- Pressroom
- RealtyElite
- Red Art
- Sala
- Samex
- WordPress Theme
- Seven Stars
- SNS Vicky
- Sofass
Themes With A Fix/Patch Available
Disclosed vulnerability(ies) have been patched. You should update to the latest version.
- Blogbyte
- Blogmine
- Blogprise
- Blogty
- Magty
- Magways
- Magze
- Neom Blog
- Amely
- DWT – Directory & Listing
- Elessi
- Greenmart
- Litho
- Puca
Looking for peace of mind and less tech stress?
Security, performance, backups, privacy, and much more – the list of tasks needed to keep your website performing at its peak can seem overwhelming and time-consuming.
Signup for one of our website care/management plans and get a tech-savvy team who are committed to your business.
Never worry about your website again.
Let Us Help YouWordPress Plugins
Plugins With No Fix/Patch Available
Disclosed vulnerability(ies) have not yet been patched. You should deactivate the plugin(s).
- Mollie Payments for WooCommerce
- WP Edit
- Cyrlitera
- HurryTimer
- YaySMTP and Email Logs
- Gmedia Photo Gallery
- Hover Effects
- Additional Order Filters for WooCommerce
- Cron Logger
- WP CTA
- Address Autocomplete via Google for Gravity Forms
- Hide Admin Bar From Front End
- Image Cleanup
- Import external attachments
- Leyka
- My Wp Brand
- ONet Regenerate Thumbnails
- Slickstream
- Virusdie
- WP Permalink Translator
- WP YouTube Live
- Writesonic
- Omnipress
- IS-theme-companion
- Football Pool
- WPB Category Slider for WooCommerce
- PlatiOnline Payments
- Spreadconnect
- Add & Replace Affiliate Links for Amazon
- Thumbnail Editor
- Trusty Whistleblowing Solution
- WP DataTable
- Dashboard Widget Sidebar
- iCount Payment Gateway
- MobiLoud
- EC Stars Rating
- Theme Junkie Team Content
- Abandoned Contact Form 7
- Accept Stripe Payments Using Contact Form 7
- Aviation Weather from NOAA
- Osom Blocks
- Accept Authorize.NET Payments Using Contact Form 7
- Content Manager Light
- WP Forum Server
- HidePost
- National Weather Service Alerts
- Navayan Subscribe
- OnionBuzz
- Pre-Publish Post Checklist
- Raise The Money
- Relocate Upload
- Twitch TV Embed Suite
- Video List Manager
- WP DB Booster
- WP Optimizer
- WPShapere Lite
- xili-dictionary
- Infility Global
- Track Everything
- Photo Express for Google
- My Resume Builder
- DirectIQ Email Marketing
- A/B Testing for WordPress
- Aioseo Multibyte Descriptions
- Backwp
- Beauty Contact Popup Form
- CMS Blocks
- Contact Form 7
- CTUsers
- Davenport
- Devnex Addons For Elementor
- Drive Folder Embedder
- enigma-buttons
- Evangelische Termine
- File Manager Plugin For WordPress
- FL3R Accessibility Suite
- Flexo Counter
- Free Downloads EDD
- FW Food Menu
- FW Gallery
- Game Users Share Buttons
- GC Social Wall
- GG Bought Together for WooCommerce
- Homerunner
- Image Shadow
- Image Slider With Description
- Amazon Products to WooCommerce
- Namasha By Mdesign
- Opal Estate Pro
- Plugin Inspector
- Podcast Feed Player Widget and Shortcode
- Post Rating and Review
- PT Project Notebooks
- Simple Link Directory
- Quick Favicon
- re.place
- Responsive Food and Drink Menu
- Owl carousel responsive
- RSS Digest
- SB Breadcrumbs
- WP SmartPay
- The Countdown
- The Pack Elementor addons
- TimeZoneCalculator
- Tournament Bracket Generator
- Rankie
- VG WORT METIS
- VR Calendar
- web-cam
- Email Address Security
- Event RSVP and Simple Event Management Plugin
- WP GDPR Cookie Consent
- JobSearch
- WP Optimize By xTraffic
- WP-PhotoNav
- WP-Recall
- WP SoundSystem
- WP Visual Sitemap
- WP Wall
- WPCRM
- WPKit For Elementor
Plugins With A Fix/Patch Available
The vulnerability(ies) have been patched. You should update to the latest version.
- Ninja Forms
- Royal Elementor Addons and Templates
- SiteOrigin Widgets Bundle
- Burst Statistics
- Firelight Lightbox
- Qi Addons For Elementor
- Usercentrics Cookiebot
- Responsive Lightbox & Gallery
- Ninja Tables – Easy Data Table Builder
- Ultra Addons for Contact Form 7
- HT Slider For Elementor
- WP Map Block
- Frontend Admin
- Charitable
- Event Manager, Events Calendar, Booking, Registrations and Tickets
- BuddyPress Docs
- WPBot
- Hotel Booking
- Post Carousel Slider for Elementor
- Responsive Blocks
- PDF Builder for WooCommerce
- HT Mega
- Off-Canvas Sidebars & Menus (Slidebars)
- Popup addon for Ninja Forms
- WP AdCenter
- Image Editor by Pixo
- Booking Calendar Contact Form
- SmartAgenda
- Conference Scheduler
- Content No Cache
- Audio Editor & Recorder
- Euro FxRef Currency Converter
- WP Front User Submit
- SERPed.net
- WP Masonry & Infinite Scroll
- isMobile() Shortcode for WordPress
- Modern Design Library
- MicroPayments
- Simple Payment
- Aiomatic
- BeeTeam368 Extensions
- BeeTeam368 Extensions Pro
- Drag and Drop Multiple File Upload (Pro) – WooCommerce
- Everest Forms Pro
- JetEngine
- BRW
- Team Showcase
- Zikzag Core
How Do I Update WordPress?
Run a full backups of your website using the backup plugin you have installed -or- using the backup feature your web host provides.
Ideally you test major functions – like ecommerce, elearning, membership functionality on a staging server first. If you site is “heavily” customized, you should also test in a staging environgment first.
Perform your updates in the order of WordPress – Theme(s) – Plugin(s). Ideally you are making note of the before and after versions.
After completed, perform a visual inspection of your site and test critical functionality that may have been affected – contact forms, subscription buttons, purchasing etc.