WordPress Vulnerability Report —June 11, 2025
Since our last report, 306 vulnerabilities have been publicly disclosed. 172 of the vulnerable plugins and themes remain unpatched.
Unfortunately, cyberattacks are increasing in volume and sophistication. They’re also increasingly aimed at small to mid-sized businesses.
Along with poor user account security, vulnerable plugins & themes are one of the main reasons WordPress websites get hacked, so run those updates.
If this seems overwhelming, talk to us about a Website Care Plan.
WordPress Core
No vulnerabilities disclosed!
WordPress 6.8.1 has been released! This maintenance release includes fixes for 15 bugs throughout Core and the Block Editor, addressing issues affecting multiple areas of WordPress, including the block editor, multisite, and REST API. For a full list, refer to the release candidate announcement.
WordPress Themes
Themes With No Fix/Patch Available
- Arlo
- BodyCenter
- CraftXtore
- Fitrush
- GiftXtore
- Petito
- Car Repair Services
- Themify Edmin
- FLAP
- FlatNews
- Inset
- Krowd
- PIMP
- PressGrid
- Revo
- SNS Anton
- Avaz
- Nitan
- Soho Hotel
- Spare
- Valen
Themes With A Fix/Patch Available
Disclosed vulnerability(ies) have been patched. You should update to the latest version.
- Courtney
- CozyStay
- GrandPrix
- Grill and Chow
- Lesya
- Lettery
- MediClinic
- Minterio
- Mr. Murphy
- RealHomes
- Starbelly
- Sweet Dessert
- TinySalt
Looking for peace of mind and less tech stress?
Security, performance, backups, privacy, and much more – the list of tasks needed to keep your website performing at its peak can seem overwhelming and time-consuming.
Signup for one of our website care/management plans and get a tech-savvy team who are committed to your business.
Never worry about your website again.
Let Us Help YouWordPress Plugins
Plugins With No Fix/Patch Available
Disclosed vulnerability(ies) have not yet been patched. You should deactivate the plugin(s).
- Widget Logic
- CubeWP
- PayU CommercePro Plugin
- WP Shopify
- ThemeHunk
- Widgetize Pages Light
- Premium Packages
- Category Icon
- Chapart
- Post Grid Master
- Booqable Rental Plugin
- Activity Plus Reloaded for BuddyPress
- Nexa Blocks
- onOffice for WP-Websites
- Simple Keyword to Link
- All Currencies for WooCommerce
- Taskbuilder
- WP Compress for MainWP
- Spice Blocks
- ACF: Yandex Maps Field
- Broadly for WordPress
- Bitly URL Shortener
- IFrame Widget
- Melipayamak
- Accessibility Suite by Ability, Inc
- Pinterest Verify Meta Tag
- Responsify WP
- Wordapp
- Spreadsheet Price Changer for WooCommerce and WP E-commerce
- WordLift
- Behance Portfolio Manager
- Wishlist
- HR Management Lite
- Multi CryptoCurrency Payments
- WP AutoKeyword
- GPP Slideshow
- Viral Loops WP Integration
- Elastic Email Subscribe Form
- Epicwin Plugin
- Read More Login
- Subscription Renewal Reminders for WooCommerce
- Pay with Contact Form 7
- Quick Event Calendar
- Recover abandoned cart for WooCommerce
- WP Media File Type Manager
- TicketBAI Facturas para WooCommerce
- One-Login
- Next Event Calendar
- WP Post Corrector
- 6Storage Rentals
- Aeroscroll Gallery
- Sola Support Tickets
- Interactive Regional Map of Africa
- SEPA Girocode
- Admin Notes
- Interactive UK Regional Map
- Bacon Ipsum
- Interactive Regional Map of Florida
- Team Builder
- Abbie Expander
- Advanced Post List
- AI Mortgage Calculator
- AppBanners
- Atelier Create CV
- Backwp
- bbPress API
- Bg Orthodox Calendar
- BNS Featured Category
- BP Profile as Homepage
- Bunny’s Print CSS
- WPCHURCH
- HyperComments
- Complete Google Seo Scan
- Contact Form
- WordPress Ajax Load More and Infinite Scroll
- CubePoints
- Custom Bulk/Quick Edit
- Custom Category/Post Type Post order
- Developer Formatter
- Slack Notifications
- ZoomSounds
- Elegant Visitor Counter
- Universal Video Player
- elfsight Contact Form widget
- Elite Video Player
- Foxit eSign for WordPress
- ESV Bible Shortcode for WordPress
- FastBook
- File Provider
- Free WP Mail SMTP
- Global Translator
- Hide It
- Hive Support
- Image Hover Effects Block
- InWave Jobs
- KI Live Video Conferences
- Konami Easter Egg
- Layouts for Elementor
- CLEVER
- Sticky Radio Player
- SHOUT
- WP Lead Capturing Pages
- MapSVG
- Mediabay
- No Spam At All
- Paged Gallery
- Payment QR WooCommerce
- Personal Favicon
- Post Author
- Post Custom Templates Lite
- Powie’s Uptime Robot
- Recent Posts Slider Responsive
- Responsive Flipbooks
- Revolution Video Player
- Runners Log
- Seofy Core
- Simple Google Static Map
- Simple Nested Menu
- SocialMark
- StageShow
- Motors – Events
- Stop Spammers
- The Holiday Calendar
- Universal Video Player
- Video Embeds
- Direct Checkout for WooCommerce Lite
- WooCommerce Photo Reviews
- WooCommerce Ultimate Gift Card
- WooBeWoo Product Filter Pro
- Wp Easy Allopass
- WP-Addpub
- WP Biographia
- WP Email Debug
- WP Featured Content Slider
- Freemind Viewer
- WP Mail Options
- WP Online Users Stats
- WP-Recall
- WP Security Master
- WP Text Expander
- YouTube Simple Gallery
Plugins With A Fix/Patch Available
The vulnerability(ies) have been patched. You should update to the latest version.
- Essential Addons for Elementor
- WP-Optimize
- Popup Maker
- Broken Link Checker
- Forminator Forms
- Ocean Extra
WP Shortcodes Plugin - Simple History
- Real Cookie Banner: GDPR & ePrivacy Cookie Consent
- Social Sharing Plugin
- Ninja Tables
- WP Table Builder – WordPress Table Plugin
- WPtouch
- Calculated Fields Form
- Greenshift
- User Profile Builder
- Sina Extension for Elementor
- Uncanny Automator
- FancyBox for WordPress
- Persian WooCommerce SMS
- Simple Membership
- RTMKit Addons for Elementor
- Print Invoice & Delivery Notes for WooCommerce
- Bit File Manager
- Welcart e-Commerce
- Backup and Staging by WP Time Capsule
- WP Travel Engine
- Store Locator WordPress
- Bellows Accordion Menu
- GamiPress
- Cookie Banner, Cookie Consent, Consent Log, Cookie Scanner, Script Blocker
- Music Player for Elementor
- Post Slider and Post Carousel with Post Vertical Scrolling Widget
- ShiftNav
- WP Multilang
- WpEvently
- WooCommerce Wishlist
- Ultimate Gift Cards for WooCommerce
- Password Policy Manager | Password Manager
- WC Vendors
- WP Social Widget
- MultiVendorX
- Everest Backup
- Min Max Step Quantity Limits Manager for WooCommerce
- Shared Files
- WordPress Comments Import & Export
- The Events Calendar Countdown Addon
Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant - Icegram Collect
- Libro de Reclamaciones y Quejas
- Newsletters
- WP Maintenance Mode & Site Under Construction
- BlockStrap Page Builder
- oik
- Trinity Audio
- Product Feed for WooCommerce
- WP Tools Repair
- Event post
- WP Gravity Forms Salesforce
- Hydra Booking
- Market Exporter
- Membership For WooCommerce
- Newspack Newsletters
- Product Catalog Simple
- Raychat
- Stock Locations for WooCommerce
- Sunshine Photo Cart: Free Client Photo Galleries for Photographers
- Vayu Blocks
- WordPress CRM Plugin
- WP Time Slots Booking Form
- WordPress Contact Forms
- WP Gravity Forms Constant Contact Plugin
- PDF for WPForms + Drag and Drop Template Builder
- Ultimate WP Mail
- FraudLabs Pro for WooCommerce
- Booking Ultra Pro Appointments Booking Calendar Plugin
- Broadstreet
- Frontend Dashboard
- WP Team
- POEditor
- WC MyParcel Belgium
- WP Page Loading
- WP Plugin Info Card
- Search with Typesense
- Verge3D Publishing and E-Commerce
- 404 Page by SeedProd
- DocsPress
- Domain For Sale, Domain appraisal, Domain auction, Domain marketplace
- Job Board Manager
- WebHotelier for WordPress
- Audio Editor & Recorder
- Employee Directory
- Knowledge Base
- Campus Directory
- MyStyle Custom Product Designer
- WP Easy Contact
- ShortLinks Pro
- LTL Freight Quotes
- Art Theme
- Civi Framework
- Crawlomatic Multisite Scraper Post Generator
- LTL Freight Quotes – Daylight Edition
- LTL Freight Quotes – Freightview Edition
- Modern Events Calendar Lite
- Nasa Core
- BRW
- NewsLetter
- Real Cookie Banner Pro
- Team Showcase
- Testimonials Showcase
- Abandoned Cart Pro for WooCommerce
- WP User Frontend Pro
- wpForo Advanced Attachments
How Do I Update WordPress?
Run a full backups of your website using the backup plugin you have installed -or- using the backup feature your web host provides.
Ideally you test major functions – like ecommerce, elearning, membership functionality on a staging server first. If you site is “heavily” customized, you should also test in a staging environgment first.
Perform your updates in the order of WordPress – Theme(s) – Plugin(s). Ideally you are making note of the before and after versions.
After completed, perform a visual inspection of your site and test critical functionality that may have been affected – contact forms, subscription buttons, purchasing etc.